CVE-2021-3129

Description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

References

https://www.bleepingcomputer.com/news/security/crystalray-hacker-expands-to-1-500-breached-systems-using-ssh-snake-tool/

https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/

https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/

https://sysdig.com/blog/rubycarp-romanian-botnet-group/

https://sysdig.com/blog/cloud-threats-deploying-crypto-cdn/

https://www.ambionics.io/blog/laravel-debug-rce

https://github.com/facade/ignition/pull/334

http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html

http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3