CVE-2021-3129 - Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents()

Back Back to CVE browser

CRITICAL KEV

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents()

Published Jan 12, 2021 ·Due Oct 9, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 99.94%

Description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (9)

http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/FriendsOfPHP/security-advisories/blob/master/facade/ignition/CVE-2021-3129.yaml
https://github.com/advisories/GHSA-4qwp-7c67-jmcc
Advisory
https://github.com/facade/ignition/commit/11ffca14abd22db779d90b12e193f8000f6d184b
https://github.com/facade/ignition/pull/334
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3129
https://www.ambionics.io/blog/laravel-debug-rce
x_refsource_MISCExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129
government-resourceUS Government Resource

Link	Providers	Tags
http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/FriendsOfPHP/security-advisories/blob/master/facade/ignition/CVE-2021-3129.yaml
https://github.com/advisories/GHSA-4qwp-7c67-jmcc		Advisory
https://github.com/facade/ignition/commit/11ffca14abd22db779d90b12e193f8000f6d184b
https://github.com/facade/ignition/pull/334		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3129
https://www.ambionics.io/blog/laravel-debug-rce		x_refsource_MISCExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129		government-resourceUS Government Resource