GitHub Advisoryadvisory · Packagist

GHSA-qvqm-h22r-4cp9 Laravel Framework RCE Vulnerability

HIGH Published 2022-05-14 Modified 2025-01-13 Official page ↗
Aliases
CVE-2018-15133
Ecosystem
Packagist
Packages
laravel/framework
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-07-22

Affected packages

• Packagist laravel/framework: <= 5.5.40 (no fix yet) • Packagist laravel/framework: >= 5.6.0, < 5.6.30 → fixed in 5.6.30

Description

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in `Illuminate/Encryption/Encrypter.php` and PendingBroadcast in `gadgetchains/Laravel/RCE/3/chain.php` in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Related

Alias · CVE (1)

  • CVE-2018-15133 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References