CVE-2018-15133
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 8.1epss 77%
from disclosure to weapon5 days
Published on NVDAug 9
1st PoC+5d
metasploitAug 7
CISA KEV+1986d
exploitation probability
77%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
27 public exploit(s)
Action required by CISAfederal deadline: 2024-02-06
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Versions
Affected
>= 0
Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 27✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/47129githubgithub.com/kozmic/laravel-poc-CVE-2018-15133★ 258githubgithub.com/aljavier/exploit_laravel_cve-2018-15133★ 57githubgithub.com/pwnedshell/Larascript★ 35githubgithub.com/Prabesh01/Laravel-PHP-Unit-RCE-Auto-shell-uploader★ 6githubgithub.com/AzhariKun/CVE-2018-15133★ 3githubgithub.com/yeahhbean/Laravel-CVE-2018-15133★ 1githubgithub.com/NatteeSetobol/CVE-2018-15133-Lavel-Expliot★ 0githubgithub.com/Cr4zyD14m0nd137/Lab-for-cve-2018-15133★ 0githubgithub.com/0xSalle/cve-2018-15133★ 0githubgithub.com/Loaxert/CVE-2018-15133-PoC★ 0githubgithub.com/bukitbarisan/laravel-rce-cve-2018-15133★ 0githubgithub.com/flame-11/CVE-2018-15133-laravel-framework★ 0githubgithub.com/AlienX2001/better-poc-for-CVE-2018-15133★ 0githubgithub.com/Bilelxdz/Laravel-CVE-2018-15133★ 0vulncheckvulncheck.com/xdb/2ce024551afbunverifiedvulncheckvulncheck.com/xdb/bb622dfa8b57unverifiedvulncheckvulncheck.com/xdb/8027eabdd92dunverifiedvulncheckvulncheck.com/xdb/b1064b8f348aunverifiedvulncheckvulncheck.com/xdb/0a29cfc05e95unverifiedvulncheckvulncheck.com/xdb/2c6de6585be5unverifiedvulncheckvulncheck.com/xdb/be7a45b53d16unverifiedvulncheckvulncheck.com/xdb/3004cb8714e9unverifiedvulncheckvulncheck.com/xdb/b31ca993356funverifiedvulncheckvulncheck.com/xdb/45e7d1957c7funverifiedvulncheckvulncheck.com/xdb/7fa45a25cb32unverifiedcve_referencepacketstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.