CVE-2018-15133: Laravel Framework RCE Vulnerability
Summary
CVE-2018-15133: Laravel Framework RCE Vulnerability. Affects laravel/framework across 2 version ranges.
< 5.5.40
>= 5.6.0, < 5.6.30
Fixed in 5.5.40 or 5.6.30, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Laravel Framework is a popular PHP web application framework that provides a robust set of tools and features for building web applications. It is widely used for its elegant syntax, powerful ORM, and extensive libraries. The framework utilizes encryption for secure data transmission and storage. However, a vulnerability has been discovered in versions 5.5.40 and 5.6.x through 5.6.29 of the Laravel Framework that can lead to remote code execution.
Vulnerability Detail
The vulnerability arises from an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This vulnerability can be exploited by an attacker to execute arbitrary code remotely. The attack involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. To successfully exploit this vulnerability, the attacker must know the application key, which is normally not accessible. However, if the attacker has previously gained privileged access or successfully executed a previous attack, they may have obtained the application key.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.5.405.5.40composer require laravel/framework:5.5.40 -
>= 5.6.0, < 5.6.305.6.30composer require laravel/framework:5.6.30
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security patches provided by the Laravel team to mitigate the risk of remote code execution.
Conclusion
The Laravel Framework is susceptible to a remote code execution vulnerability that can be exploited by an attacker with knowledge of the application key. To mitigate this risk, it is essential to upgrade to the latest patched version of the Laravel Framework and keep the application key secure. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your Laravel installation.
See every vulnerability recorded for laravel/framework →
FAQ
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to a complete compromise of the affected system. This can result in unauthorized access, data theft, or disruption of services.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
Yes, the CVSS score for this vulnerability is 8.1, indicating a high severity level.
In most cases, the attacker would require privileged access or a successful previous attack to obtain the application key necessary for exploiting this vulnerability.
There have been reported instances of this vulnerability being exploited in the wild. It is crucial to apply the security patches and take necessary precautions to protect your Laravel installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
