CVE-2021-3129 PoC — Facade Ignition for Laravel 授权问题漏洞

Source

https://github.com/cc3305/CVE-2021-3129

Associated Vulnerability

Title: Facade Ignition for Laravel 授权问题漏洞 (CVE-2021-3129)
Description:Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Description

A exploit script for CVE-2021-3129

Readme

# CVE-2021-3129

> Unauthenticated RCE in Laravel Ignition via File Upload

## Summary of the CVE

In affected versions of Laravel Ignition a attack can execute arbitrary code because of the insecure usage of `file_get_contents()` and `file_put_contents()`. 
This is only exploitable for websites that use debug mode.

## Affected Versions

- Laravel Ignition < 2.5.2 and Laravel < 8.4.2

## Anomalies

- This exploit needs a php gadget and is therefore using phpggc. You can do this the following ways:
    - If you haven't already cloned: `git clone https://github.com/cc3305/CVE-2021-3129.git --recursive --shallow-submodules`.
    - Or if you have already cloned in, run this in the local git repo `git submodule update --init --depth 1`.

## References

- [Original Report - Charles Fol, Jan 12 2021](https://www.ambionics.io/blog/laravel-debug-rce)
- [First Github POC - SNCKER, Jan 24 2021](https://github.com/SNCKER/CVE-2021-3129)
- [Github POC - joshuavanderpoll, Aug 16 2023](https://github.com/joshuavanderpoll/CVE-2021-3129)
- [CVE-details - CVSS Score 7.5](https://www.cvedetails.com/cve/CVE-2021-3129/)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →