CVE-2021-3129
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 9.8epss 100%
da publicação à arma1 dias
Publicada no NVD12 de jan.
1ª PoC+1d
metasploit+1d
CISA KEV+979d
probabilidade de exploração
100%top 1% das CVEs
exploração observada
simCISA + VulnCheck
66 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2023-10-09
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · n/aPoCs públicas encontradas — 66
exploitdbwww.exploit-db.com/exploits/49424não verificadogithubgithub.com/ambionics/laravel-exploits★ 289githubgithub.com/zhzyker/CVE-2021-3129★ 163githubgithub.com/joshuavanderpoll/CVE-2021-3129★ 148githubgithub.com/SNCKER/CVE-2021-3129★ 135githubgithub.com/SecPros-Team/laravel-CVE-2021-3129-EXP★ 78githubgithub.com/nth347/CVE-2021-3129_exploit★ 69githubgithub.com/crisprss/Laravel_CVE-2021-3129_EXP★ 18githubgithub.com/ajisai-babu/CVE-2021-3129-exp★ 13githubgithub.com/knqyf263/CVE-2021-3129★ 12githubgithub.com/0x0d3ad/CVE-2021-3129★ 10githubgithub.com/MadExploits/Laravel-debug-Checker★ 7githubgithub.com/0nion1/CVE-2021-3129★ 6githubgithub.com/shadowabi/Laravel-CVE-2021-3129★ 5githubgithub.com/Axianke/CVE-2021-3129★ 5githubgithub.com/wmasday/CVE-2021-3129★ 2githubgithub.com/FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129★ 2githubgithub.com/keyuan15/CVE-2021-3129★ 1githubgithub.com/lukwagoasuman/CVE-2021-3129---Laravel-RCE★ 1githubgithub.com/idea-oss/laravel-CVE-2021-3129-EXP★ 1githubgithub.com/hupe1980/CVE-2021-3129★ 0githubgithub.com/Y0s9/CVE-2021-3129★ 0githubgithub.com/piperpwn/CVE-2021-3129-piperpwn★ 0githubgithub.com/GodOfServer/CVE-2021-3129★ 0githubgithub.com/Prabesh01/hoh4★ 0githubgithub.com/theNareshofficial/CVE-2021-3129-Lab★ 0githubgithub.com/cc3305/CVE-2021-3129★ 0githubgithub.com/qaisarafridi/cve-2021-3129★ 0githubgithub.com/Zoo1sondv/CVE-2021-3129★ 0githubgithub.com/miko550/CVE-2021-3129★ 0githubgithub.com/banyaksepuh/Mass-CVE-2021-3129-Scanner★ 0vulncheckvulncheck.com/xdb/d4c406d658a9não verificadovulncheckvulncheck.com/xdb/4b3627899025não verificadovulncheckvulncheck.com/xdb/8d11909030a5não verificadovulncheckvulncheck.com/xdb/bb9ba40b9c86não verificadovulncheckvulncheck.com/xdb/db67e867eebdnão verificadocve_referencepacketstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.htmlnão verificadocve_referencepacketstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.htmlnão verificadovulncheckvulncheck.com/xdb/8168517a0701não verificadovulncheckvulncheck.com/xdb/87edd3bbabdfnão verificadovulncheckvulncheck.com/xdb/0f3a032cb75bnão verificadovulncheckvulncheck.com/xdb/686106caeaabnão verificadovulncheckvulncheck.com/xdb/a310e9e90d01não verificadovulncheckvulncheck.com/xdb/d6fabfe71d88não verificadovulncheckvulncheck.com/xdb/35724c55fdc0não verificadovulncheckvulncheck.com/xdb/067f7c923e08não verificadovulncheckvulncheck.com/xdb/ef7d2df1ab88não verificadovulncheckvulncheck.com/xdb/fcb02bd261dbnão verificadovulncheckvulncheck.com/xdb/e9d83dcde53dnão verificadovulncheckvulncheck.com/xdb/d69431f93556não verificadovulncheckvulncheck.com/xdb/570147c7cbc0não verificadovulncheckvulncheck.com/xdb/3a52a9c9227fnão verificadovulncheckvulncheck.com/xdb/504b16c118c4não verificadovulncheckvulncheck.com/xdb/8773f8dc585anão verificadovulncheckvulncheck.com/xdb/47a1b3108a7cnão verificadovulncheckvulncheck.com/xdb/6f534d028d6fnão verificadovulncheckvulncheck.com/xdb/b58398140e57não verificadovulncheckvulncheck.com/xdb/76a6df778206não verificadovulncheckvulncheck.com/xdb/ca8748e2b909não verificadovulncheckvulncheck.com/xdb/78b35be1dc24não verificadovulncheckvulncheck.com/xdb/f500f5c13d9cnão verificadovulncheckvulncheck.com/xdb/9612bcbc8150não verificadovulncheckvulncheck.com/xdb/633a39ff42e5não verificadovulncheckvulncheck.com/xdb/3f630a9ea757não verificadovulncheckvulncheck.com/xdb/5f4cc8cb7fe8não verificadovulncheckvulncheck.com/xdb/9a17d0a89e57não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.htmlhttps://github.com/facade/ignition/pull/334https://www.ambionics.io/blog/laravel-debug-rcehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129