Vulnerabilities > CVE-2018-15133 - Deserialization of Untrusted Data vulnerability in Laravel

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

high complexity

laravel

CWE-502

exploit available

metasploit

NVD

Published: 2018-08-09

Updated: 2024-01-17

Summary

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Vulnerable Configurations

Part	Description	Count
Application	Laravel Laravel Laravel 3.0.0 Laravel Laravel 3.0.1 Laravel Laravel 3.0.2 Laravel Laravel 3.0.3 Laravel Laravel 3.0.4 Laravel Laravel 3.1.0 Laravel Laravel 3.1.1 Laravel Laravel 3.1.2 Laravel Laravel 3.1.3 Laravel Laravel 3.1.4 Laravel Laravel 3.1.5 Laravel Laravel 3.1.6 Laravel Laravel 3.1.7 Laravel Laravel 3.1.8 Laravel Laravel 3.1.9 Laravel Laravel 3.2.0 Laravel Laravel 3.2.1 Laravel Laravel 3.2.3 Laravel Laravel 3.2.4 Laravel Laravel 3.2.5 Laravel Laravel 3.2.6 Laravel Laravel 3.2.7 Laravel Laravel 3.2.8 Laravel Laravel 3.2.9 Laravel Laravel 3.2.10 Laravel Laravel 3.2.11 Laravel Laravel 3.2.12 Laravel Laravel 3.2.13 Laravel Laravel 3.2.14 Laravel Laravel 4.0.0 Laravel Laravel 4.0.1 Laravel Laravel 4.0.2 Laravel Laravel 4.0.3 Laravel Laravel 4.0.4 Laravel Laravel 4.0.5 Laravel Laravel 4.0.6 Laravel Laravel 4.0.7 Laravel Laravel 4.0.8 Laravel Laravel 4.0.9 Laravel Laravel 4.0.10 Laravel Laravel 4.0.11 Laravel Laravel 4.1.0 Laravel Laravel 4.1.1 Laravel Laravel 4.1.2 Laravel Laravel 4.1.3 Laravel Laravel 4.1.4 Laravel Laravel 4.1.5 Laravel Laravel 4.1.6 Laravel Laravel 4.1.7 Laravel Laravel 4.1.8 Laravel Laravel 4.1.9 Laravel Laravel 4.1.10 Laravel Laravel 4.1.11 Laravel Laravel 4.1.12 Laravel Laravel 4.1.13 Laravel Laravel 4.1.14 Laravel Laravel 4.1.15 Laravel Laravel 4.1.16 Laravel Laravel 4.1.17 Laravel Laravel 4.1.18 Laravel Laravel 4.1.19 Laravel Laravel 4.1.20 Laravel Laravel 4.1.21 Laravel Laravel 4.1.22 Laravel Laravel 4.1.23 Laravel Laravel 4.1.24 Laravel Laravel 4.1.25 Laravel Laravel 4.1.26 Laravel Laravel 4.1.27 Laravel Laravel 4.1.28 Laravel Laravel 4.1.29 Laravel Laravel 4.1.30 Laravel Laravel 4.1.31 Laravel Laravel 4.2.0 Laravel Laravel 4.2.1 Laravel Laravel 4.2.2 Laravel Laravel 4.2.3 Laravel Laravel 4.2.4 Laravel Laravel 4.2.5 Laravel Laravel 4.2.6 Laravel Laravel 4.2.7 Laravel Laravel 4.2.8 Laravel Laravel 4.2.9 Laravel Laravel 4.2.10 Laravel Laravel 4.2.11 Laravel Laravel 4.2.12 Laravel Laravel 4.2.13 Laravel Laravel 4.2.14 Laravel Laravel 4.2.15 Laravel Laravel 4.2.16 Laravel Laravel 4.2.17 Laravel Laravel 4.2.18 Laravel Laravel 4.2.19 Laravel Laravel 4.2.20 Laravel Laravel 4.2.21 Laravel Laravel 4.2.22 Laravel Laravel 5.0.0 Laravel Laravel 5.0.1 Laravel Laravel 5.0.2 Laravel Laravel 5.0.3 Laravel Laravel 5.0.4 Laravel Laravel 5.0.5 Laravel Laravel 5.0.6 Laravel Laravel 5.0.7 Laravel Laravel 5.0.8 Laravel Laravel 5.0.9 Laravel Laravel 5.0.10 Laravel Laravel 5.0.11 Laravel Laravel 5.0.12 Laravel Laravel 5.0.13 Laravel Laravel 5.0.14 Laravel Laravel 5.0.15 Laravel Laravel 5.0.16 Laravel Laravel 5.0.17 Laravel Laravel 5.0.18 Laravel Laravel 5.0.19 Laravel Laravel 5.0.20 Laravel Laravel 5.0.21 Laravel Laravel 5.0.22 Laravel Laravel 5.0.23 Laravel Laravel 5.0.24 Laravel Laravel 5.0.25 Laravel Laravel 5.0.26 Laravel Laravel 5.0.27 Laravel Laravel 5.0.28 Laravel Laravel 5.0.29 Laravel Laravel 5.0.30 Laravel Laravel 5.0.31 Laravel Laravel 5.0.32 Laravel Laravel 5.0.33 Laravel Laravel 5.0.34 Laravel Laravel 5.0.35 Laravel Laravel 5.1.0 Laravel Laravel 5.1.1 Laravel Laravel 5.1.2 Laravel Laravel 5.1.3 Laravel Laravel 5.1.4 Laravel Laravel 5.1.5 Laravel Laravel 5.1.6 Laravel Laravel 5.1.7 Laravel Laravel 5.1.8 Laravel Laravel 5.1.9 Laravel Laravel 5.1.10 Laravel Laravel 5.1.11 Laravel Laravel 5.1.12 Laravel Laravel 5.1.13 Laravel Laravel 5.1.14 Laravel Laravel 5.1.15 Laravel Laravel 5.1.16 Laravel Laravel 5.1.17 Laravel Laravel 5.1.18 Laravel Laravel 5.1.19 Laravel Laravel 5.1.20 Laravel Laravel 5.1.21 Laravel Laravel 5.1.22 Laravel Laravel 5.1.23 Laravel Laravel 5.1.24 Laravel Laravel 5.1.25 Laravel Laravel 5.1.26 Laravel Laravel 5.1.27 Laravel Laravel 5.1.28 Laravel Laravel 5.1.29 Laravel Laravel 5.1.30 Laravel Laravel 5.1.31 Laravel Laravel 5.1.32 Laravel Laravel 5.1.33 Laravel Laravel 5.1.34 Laravel Laravel 5.1.35 Laravel Laravel 5.1.36 Laravel Laravel 5.1.37 Laravel Laravel 5.1.38 Laravel Laravel 5.1.39 Laravel Laravel 5.1.40 Laravel Laravel 5.1.41 Laravel Laravel 5.1.42 Laravel Laravel 5.1.43 Laravel Laravel 5.1.44 Laravel Laravel 5.1.45 Laravel Laravel 5.1.46 Laravel Laravel 5.2.0 Laravel Laravel 5.2.1 Laravel Laravel 5.2.2 Laravel Laravel 5.2.3 Laravel Laravel 5.2.4 Laravel Laravel 5.2.5 Laravel Laravel 5.2.6 Laravel Laravel 5.2.7 Laravel Laravel 5.2.8 Laravel Laravel 5.2.9 Laravel Laravel 5.2.10 Laravel Laravel 5.2.11 Laravel Laravel 5.2.12 Laravel Laravel 5.2.13 Laravel Laravel 5.2.14 Laravel Laravel 5.2.15 Laravel Laravel 5.2.16 Laravel Laravel 5.2.17 Laravel Laravel 5.2.18 Laravel Laravel 5.2.19 Laravel Laravel 5.2.20 Laravel Laravel 5.2.21 Laravel Laravel 5.2.22 Laravel Laravel 5.2.23 Laravel Laravel 5.2.24 Laravel Laravel 5.2.25 Laravel Laravel 5.2.26 Laravel Laravel 5.2.27 Laravel Laravel 5.2.28 Laravel Laravel 5.2.29 Laravel Laravel 5.2.30 Laravel Laravel 5.2.31 Laravel Laravel 5.2.32 Laravel Laravel 5.2.33 Laravel Laravel 5.2.34 Laravel Laravel 5.2.35 Laravel Laravel 5.2.36 Laravel Laravel 5.2.37 Laravel Laravel 5.2.38 Laravel Laravel 5.2.39 Laravel Laravel 5.2.40 Laravel Laravel 5.2.41 Laravel Laravel 5.2.42 Laravel Laravel 5.2.43 Laravel Laravel 5.2.44 Laravel Laravel 5.2.45 Laravel Laravel 5.3.0 Laravel Laravel 5.3.1 Laravel Laravel 5.3.2 Laravel Laravel 5.3.3 Laravel Laravel 5.3.4 Laravel Laravel 5.3.5 Laravel Laravel 5.3.6 Laravel Laravel 5.3.7 Laravel Laravel 5.3.8 Laravel Laravel 5.3.9 Laravel Laravel 5.3.10 Laravel Laravel 5.3.11 Laravel Laravel 5.3.12 Laravel Laravel 5.3.13 Laravel Laravel 5.3.14 Laravel Laravel 5.3.15 Laravel Laravel 5.3.16 Laravel Laravel 5.3.17 Laravel Laravel 5.3.18 Laravel Laravel 5.3.19 Laravel Laravel 5.3.20 Laravel Laravel 5.3.21 Laravel Laravel 5.3.22 Laravel Laravel 5.3.23 Laravel Laravel 5.3.24 Laravel Laravel 5.3.25 Laravel Laravel 5.3.26 Laravel Laravel 5.3.27 Laravel Laravel 5.3.28 Laravel Laravel 5.3.29 Laravel Laravel 5.3.30 Laravel Laravel 5.3.31 Laravel Laravel 5.4.0 Laravel Laravel 5.4.1 Laravel Laravel 5.4.2 Laravel Laravel 5.4.3 Laravel Laravel 5.4.4 Laravel Laravel 5.4.5 Laravel Laravel 5.4.6 Laravel Laravel 5.4.7 Laravel Laravel 5.4.8 Laravel Laravel 5.4.9 Laravel Laravel 5.4.10 Laravel Laravel 5.4.11 Laravel Laravel 5.4.12 Laravel Laravel 5.4.13 Laravel Laravel 5.4.14 Laravel Laravel 5.4.15 Laravel Laravel 5.4.16 Laravel Laravel 5.4.17 Laravel Laravel 5.4.18 Laravel Laravel 5.4.19 Laravel Laravel 5.4.20 Laravel Laravel 5.4.21 Laravel Laravel 5.4.22 Laravel Laravel 5.4.23 Laravel Laravel 5.4.24 Laravel Laravel 5.4.25 Laravel Laravel 5.4.26 Laravel Laravel 5.4.27 Laravel Laravel 5.4.28 Laravel Laravel 5.4.29 Laravel Laravel 5.4.30 Laravel Laravel 5.4.31 Laravel Laravel 5.4.32 Laravel Laravel 5.4.33 Laravel Laravel 5.4.34 Laravel Laravel 5.4.35 Laravel Laravel 5.4.36 Laravel Laravel 5.5.0 Laravel Laravel 5.5.1 Laravel Laravel 5.5.2 Laravel Laravel 5.5.3 Laravel Laravel 5.5.4 Laravel Laravel 5.5.5 Laravel Laravel 5.5.6 Laravel Laravel 5.5.7 Laravel Laravel 5.5.8 Laravel Laravel 5.5.9 Laravel Laravel 5.5.10 Laravel Laravel 5.5.11 Laravel Laravel 5.5.12 Laravel Laravel 5.5.13 Laravel Laravel 5.5.14 Laravel Laravel 5.5.15 Laravel Laravel 5.5.16 Laravel Laravel 5.5.17 Laravel Laravel 5.5.18 Laravel Laravel 5.5.19 Laravel Laravel 5.5.20 Laravel Laravel 5.5.21 Laravel Laravel 5.5.22 Laravel Laravel 5.5.23 Laravel Laravel 5.5.24 Laravel Laravel 5.5.25 Laravel Laravel 5.5.26 Laravel Laravel 5.5.27 Laravel Laravel 5.5.28 Laravel Laravel 5.5.29 Laravel Laravel 5.5.30 Laravel Laravel 5.5.31 Laravel Laravel 5.5.32 Laravel Laravel 5.5.33 Laravel Laravel 5.5.34 Laravel Laravel 5.5.35 Laravel Laravel 5.5.36 Laravel Laravel 5.5.37 Laravel Laravel 5.5.38 Laravel Laravel 5.5.39 Laravel Laravel 5.5.40 Laravel Laravel 5.6.0 Laravel Laravel 5.6.1 Laravel Laravel 5.6.2 Laravel Laravel 5.6.3 Laravel Laravel 5.6.4 Laravel Laravel 5.6.5 Laravel Laravel 5.6.6 Laravel Laravel 5.6.7 Laravel Laravel 5.6.8 Laravel Laravel 5.6.9 Laravel Laravel 5.6.10 Laravel Laravel 5.6.11 Laravel Laravel 5.6.12 Laravel Laravel 5.6.13 Laravel Laravel 5.6.14 Laravel Laravel 5.6.15 Laravel Laravel 5.6.16 Laravel Laravel 5.6.17 Laravel Laravel 5.6.18 Laravel Laravel 5.6.19 Laravel Laravel 5.6.20 Laravel Laravel 5.6.21 Laravel Laravel 5.6.22 Laravel Laravel 5.6.23 Laravel Laravel 5.6.24 Laravel Laravel 5.6.25 Laravel Laravel 5.6.26 Laravel Laravel 5.6.27 Laravel Laravel 5.6.28 Laravel Laravel 5.6.29	375

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Exploit-Db

id	EDB-ID:47129
last seen	2019-07-16
modified	2019-07-16
published	2019-07-16
reporter	Exploit-DB
source	https://www.exploit-db.com/download/47129
title	PHP Laravel Framework 5.5.40 / 5.6.x < 5.6.30 - token Unserialize Remote Command Execution (Metasploit)

Metasploit

description	This module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x <= 5.6.29. Remote Command Execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to an insecure unserialize call of the decrypt method in Illuminate/Encryption/Encrypter.php. Authentication is not required, however exploitation requires knowledge of the Laravel APP_KEY. Similar vulnerabilities appear to exist within Laravel cookie tokens based on the code fix. In some cases the APP_KEY is leaked which allows for discovery and exploitation.
id	MSF:EXPLOIT/UNIX/HTTP/LARAVEL_TOKEN_UNSERIALIZE_EXEC
last seen	2020-05-31
modified	2019-07-12
published	2019-07-07
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15133 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16894 https://github.com/kozmic/laravel-poc-CVE-2018-15133 https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30 https://github.com/laravel/framework/pull/25121/commits/d84cf988ed5d4661a4bf1fdcb08f5073835083a0
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/unix/http/laravel_token_unserialize_exec.rb
title	PHP Laravel Framework token Unserialize Remote Command Execution

Packetstorm

data source	https://packetstormsecurity.com/files/download/153641/laravel_token_unserialize_exec.rb.txt
id	PACKETSTORM:153641
last seen	2019-07-15
published	2019-07-15
reporter	aushack
source	https://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html
title	PHP Laravel Framework Token Unserialize Remote Command Execution

Vulnerabilities > CVE-2018-15133 - Deserialization of Untrusted Data vulnerability in Laravel

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Exploit-Db

Metasploit

Packetstorm

Related news

References