CVE-2021-3129

Laravel Ignition File Upload Vulnerability

Ignition

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

12. Jan 2021

Ausgewertete Quellen

• Hinweis
  http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html
• Hinweis
  http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html
• Hinweis
  https://www.ambionics.io/blog/laravel-debug-rce
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129
• CISA
  Laravel Ignition File Upload Vulnerability
• NVD
  CVE-2021-3129
• GitHub
  https://github.com/facade/ignition/pull/334