Laravel Framework RCE Vulnerability
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpgg…
As published by the sources
Affected packages
- Affected
<=5.5.40 || >=5.6.0,<5.6.30Fixed in5.6.30
Derived from the fixed versions above
What to do
Upgrade laravel/framework to 5.6.30 or later.
composer update laravel/framework --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
References
- Advisoryhttps://github.com/advisories/GHSA-qvqm-h22r-4cp9
- Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2018-15133
- Webhttps://github.com/laravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083a0
- Webhttps://github.com/kozmic/laravel-poc-CVE-2018-15133
- Packagehttps://github.com/laravel/framework
- Webhttps://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
- Webhttp://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html