CVE-2021-3129 PoC — Facade Ignition for Laravel 授权问题漏洞

Source

https://github.com/cc3305/CVE-2021-3129

Associated Vulnerability

Title:Facade Ignition for Laravel 授权问题漏洞 (CVE-2021-3129)
Description:Facade Ignition for Laravel是比利时Facade公司的一款运行在Laravel Web框架中的可自定义的错误页面。 Ignition for Laravel 2.5.2之前版本存在授权问题漏洞，该漏洞源于程序未进行正确的身份验证，攻击者可利用该漏洞执行任意代码。

Description

A exploit script for CVE-2021-3129

Readme

# CVE-2021-3129

> Unauthenticated RCE in Laravel Ignition via File Upload

## Summary of the CVE

In affected versions of Laravel Ignition a attack can execute arbitrary code because of the insecure usage of `file_get_contents()` and `file_put_contents()`. 
This is only exploitable for websites that use debug mode.

## Affected Versions

- Laravel Ignition < 2.5.2 and Laravel < 8.4.2

## Anomalies

- This exploit needs a php gadget and is therefore using phpggc. You can do this the following ways:
    - If you haven't already cloned: `git clone https://github.com/cc3305/CVE-2021-3129.git --recursive --shallow-submodules`.
    - Or if you have already cloned in, run this in the local git repo `git submodule update --init --depth 1`.

## References

- [Original Report - Charles Fol, Jan 12 2021](https://www.ambionics.io/blog/laravel-debug-rce)
- [First Github POC - SNCKER, Jan 24 2021](https://github.com/SNCKER/CVE-2021-3129)
- [Github POC - joshuavanderpoll, Aug 16 2023](https://github.com/joshuavanderpoll/CVE-2021-3129)
- [CVE-details - CVSS Score 7.5](https://www.cvedetails.com/cve/CVE-2021-3129/)

File Snapshot


 [4.0K]  /data/pocs/22523ca320b4679e60d808c7226106c0678b3149
├── [ 13K]  CVE-2021-3129.py
├── [4.0K]  phpggc
└── [1.1K]  README.md

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!