Actively exploited · Published Aug 9, 2018 · Assigned by mitre
CVE-2018-15133
High 8.1 Exploited
In plain English
A high-severity unsafe deserialization in Laravel Framework from Laravel. Attackers are actively exploiting it in the wild (listed by CISA on January 16, 2024). The chance it is exploited in the next 30 days is estimated at 76.6% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 6, 2024.
Official description
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | laravel/framework | no fix listed | GHSA-qvqm-h22r-4cp9 |
| Packagist | laravel/framework | 5.6.30 | GHSA-qvqm-h22r-4cp9 |
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30 x_refsource_CONFIRM
- http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133 government-resource