Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-02-06. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
@PovilasKorop Laravel version of that: agents read .env, and the key teams forget to rotate after exposure is APP_KEY. Anyone holding it can forge encrypted payloads; on older Laravel that meant RCE (CVE-2018-15133). Rotate it along with the cloud keys.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | laravel | laravel | - | - | - |