关联漏洞
标题：
LaRecipe 安全漏洞
(CVE-2025-53833)
描述：LaRecipe是Saleem Hadad سليم حداد个人开发者的一个使用MarkDown为Laravel应用程序编写和发布文档的软件。 LaRecipe 2.8.1之前版本存在安全漏洞，该漏洞源于服务器端模板注入，可能导致远程代码执行。
描述
CVE-2025-53833
介绍
# **🚨 CVE-2025-53833 — Critical ⚠️ SSTI ➜ RCE in LaRecipe (Versions < 2.8.1)**
<img width="960" height="360" alt="0_Y6-sjR9flQFzhYmr" src="https://github.com/user-attachments/assets/d521237a-6623-422c-be76-de69f39d9e9f" />
---
### 📌 Overview
* **Vulnerability ID**: CVE-2025-53833
* **Component Affected**: LaRecipe (a Laravel-based documentation generator)
* **Versions Affected**: All versions **prior to 2.8.1**
* **Vulnerability Type**: Server-Side Template Injection (SSTI)
* **Severity**: **Critical** (CVSS 10.0)
---
### ⚠️ Impact
This vulnerability allows unauthenticated attackers to:
* Inject malicious template expressions
* Execute arbitrary **remote code** on the server
* Read sensitive files like `.env` containing **database passwords, API keys, and secrets**
* Escalate privileges or even achieve **root access**
No prior authentication or user interaction is required.
---
### 🧠 Technical Insight
The flaw lies in how LaRecipe renders documentation templates. Malicious input is not properly sanitized before being passed into the templating engine, leading to full control over the rendering logic—hence, code execution.
Example:
An attacker could inject something like `{{ system('id') }}` into a template-rendering route and execute OS-level commands.
---
### ✅ Mitigation
To protect your system:
1. **Upgrade immediately** to **LaRecipe version 2.8.1 or later**
2. If you cannot upgrade:
* **Restrict access** to documentation endpoints using HTTP authentication or IP whitelisting
* **Disable LaRecipe** temporarily if it’s not critical
3. **Monitor** server logs for suspicious activity, especially access to documentation routes
4. **Review** `.env` and other sensitive files for unauthorized access or changes
---
### 🧩 Summary
| Category | Info |
| --------------- | -------------------------------- |
| Type | SSTI → RCE |
| Scope | Unauthenticated users |
| Exploitable via | Public documentation endpoints |
| Patch | Upgrade to 2.8.1+ |
| Urgency | Critical – patch **immediately** |
---
### **🔒 Disclaimer:**
This information is provided for **educational and defensive purposes only**. Exploiting vulnerabilities without proper authorization is **illegal and unethical**. Always ensure you have **explicit permission** before conducting any form of security testing. The author is not responsible for any misuse of the content provided.
---
文件快照
[4.0K] /data/pocs/4585240ab3b4f3a47ffabb5ccc1c7b918de45cb0
└── [2.5K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。