CVE-2021-3129
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.8epss 100%
de la publicación al arma1 días
Publicada en NVD12 ene
1ª PoC+1d
metasploit+1d
CISA KEV+979d
probabilidad de explotación
100%top 1% de las CVE
explotación observada
síCISA + VulnCheck
68 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2023-10-09
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
n/a · n/aPoCs públicas encontradas — 68
exploitdbwww.exploit-db.com/exploits/49424no verificadogithubgithub.com/ambionics/laravel-exploits★ 289githubgithub.com/zhzyker/CVE-2021-3129★ 163githubgithub.com/joshuavanderpoll/CVE-2021-3129★ 148githubgithub.com/SNCKER/CVE-2021-3129★ 135githubgithub.com/SecPros-Team/laravel-CVE-2021-3129-EXP★ 78githubgithub.com/nth347/CVE-2021-3129_exploit★ 69githubgithub.com/crisprss/Laravel_CVE-2021-3129_EXP★ 18githubgithub.com/ajisai-babu/CVE-2021-3129-exp★ 13githubgithub.com/knqyf263/CVE-2021-3129★ 12githubgithub.com/0x0d3ad/CVE-2021-3129★ 10githubgithub.com/MadExploits/Laravel-debug-Checker★ 7githubgithub.com/0nion1/CVE-2021-3129★ 6githubgithub.com/shadowabi/Laravel-CVE-2021-3129★ 5githubgithub.com/Axianke/CVE-2021-3129★ 5githubgithub.com/FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129★ 2githubgithub.com/wmasday/CVE-2021-3129★ 2githubgithub.com/idea-oss/laravel-CVE-2021-3129-EXP★ 1githubgithub.com/keyuan15/CVE-2021-3129★ 1githubgithub.com/lukwagoasuman/CVE-2021-3129---Laravel-RCE★ 1githubgithub.com/Zoo1sondv/CVE-2021-3129★ 0githubgithub.com/banyaksepuh/Mass-CVE-2021-3129-Scanner★ 0githubgithub.com/Y0s9/CVE-2021-3129★ 0githubgithub.com/cc3305/CVE-2021-3129★ 0githubgithub.com/piperpwn/CVE-2021-3129-piperpwn★ 0githubgithub.com/hupe1980/CVE-2021-3129★ 0githubgithub.com/GodOfServer/CVE-2021-3129★ 0githubgithub.com/Prabesh01/hoh4★ 0githubgithub.com/qaisarafridi/cve-2021-3129★ 0githubgithub.com/theNareshofficial/CVE-2021-3129-Lab★ 0githubgithub.com/miko550/CVE-2021-3129★ 0vulncheckvulncheck.com/xdb/d4c406d658a9no verificadovulncheckvulncheck.com/xdb/db67e867eebdno verificadovulncheckvulncheck.com/xdb/4b3627899025no verificadovulncheckvulncheck.com/xdb/bb9ba40b9c86no verificadovulncheckvulncheck.com/xdb/131bacbc2679no verificadovulncheckvulncheck.com/xdb/05a0424b5115no verificadovulncheckvulncheck.com/xdb/8d11909030a5no verificadocve_referencepacketstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.htmlno verificadocve_referencepacketstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/8168517a0701no verificadovulncheckvulncheck.com/xdb/87edd3bbabdfno verificadovulncheckvulncheck.com/xdb/0f3a032cb75bno verificadovulncheckvulncheck.com/xdb/686106caeaabno verificadovulncheckvulncheck.com/xdb/a310e9e90d01no verificadovulncheckvulncheck.com/xdb/d6fabfe71d88no verificadovulncheckvulncheck.com/xdb/35724c55fdc0no verificadovulncheckvulncheck.com/xdb/067f7c923e08no verificadovulncheckvulncheck.com/xdb/ef7d2df1ab88no verificadovulncheckvulncheck.com/xdb/fcb02bd261dbno verificadovulncheckvulncheck.com/xdb/e9d83dcde53dno verificadovulncheckvulncheck.com/xdb/d69431f93556no verificadovulncheckvulncheck.com/xdb/570147c7cbc0no verificadovulncheckvulncheck.com/xdb/3a52a9c9227fno verificadovulncheckvulncheck.com/xdb/504b16c118c4no verificadovulncheckvulncheck.com/xdb/8773f8dc585ano verificadovulncheckvulncheck.com/xdb/47a1b3108a7cno verificadovulncheckvulncheck.com/xdb/6f534d028d6fno verificadovulncheckvulncheck.com/xdb/b58398140e57no verificadovulncheckvulncheck.com/xdb/76a6df778206no verificadovulncheckvulncheck.com/xdb/ca8748e2b909no verificadovulncheckvulncheck.com/xdb/78b35be1dc24no verificadovulncheckvulncheck.com/xdb/f500f5c13d9cno verificadovulncheckvulncheck.com/xdb/9612bcbc8150no verificadovulncheckvulncheck.com/xdb/633a39ff42e5no verificadovulncheckvulncheck.com/xdb/3f630a9ea757no verificadovulncheckvulncheck.com/xdb/5f4cc8cb7fe8no verificadovulncheckvulncheck.com/xdb/9a17d0a89e57no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.htmlhttps://github.com/facade/ignition/pull/334https://www.ambionics.io/blog/laravel-debug-rcehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129