Actively exploited · Published Jan 12, 2021 · Assigned by mitre
CVE-2021-3129
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity security flaw in Ignition from Laravel. Attackers are actively exploiting it in the wild (listed by CISA on September 18, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 9, 2023.
Official description
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | facade/ignition | 2.5.2 | GHSA-4qwp-7c67-jmcc |
| Packagist | facade/ignition | 2.4.2 | GHSA-4qwp-7c67-jmcc |
| Packagist | facade/ignition | 1.16.14 | GHSA-4qwp-7c67-jmcc |
| Packagist | facade/ignition | 1.6.15 | GHSA-4qwp-7c67-jmcc |
Affected products (as reported)
References
- https://www.ambionics.io/blog/laravel-debug-rce x_refsource_MISC
- https://github.com/facade/ignition/pull/334 x_refsource_MISC
- http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html x_refsource_MISC
- http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129 government-resource