Laravel Framework RCE Vulnerability

CAO 8.1ĐANG BỊ KHAI THÁC (CISA KEV)CVE-2018-15133 · GHSA-qvqm-h22r-4cp9 · Công bố 09/08/2018 · cập nhật 17/06/2026

Laravel Deserialization of Untrusted Data Vulnerability. Đang bị khai thác thực tế: CISA đưa lỗ hổng này vào danh mục Known Exploited Vulnerabilities ngày 16/01/2024. Hãy vá các hệ thống bị ảnh hưởng ngay.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
laravel/framework Packagist	`≥ 5.6.0, < 5.6.30≤ 5.5.40`	`5.6.30`
laravel laravel	`≥ 5.6.0, ≤ 5.6.29≤ 5.5.40`	Chưa có bản vá

Mô tả

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Mô tả của NVD

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2018-15133 · ADVISORY
laravel/framework commit d84cf98 · WEB
kozmic/laravel-poc-CVE-2018-15133 · WEB
laravel/framework · PACKAGE
laravel.com/docs/5.6/upgrade · WEB
packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html · WEB
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2018-15133

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí

Gói / sản phẩm

Phiên bản bị ảnh hưởng

Phiên bản đã vá

laravel/framework

Packagist

≥ 5.6.0, < 5.6.30≤ 5.5.40

5.6.30

laravel

≥ 5.6.0, ≤ 5.6.29≤ 5.5.40

Chưa có bản vá

Mô tả

Mô tả của NVD

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.