FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129

GitHubRepository PoC

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

2
GitHub

docker-compose.yml

Created Vuln labCVE-2021-3129Compose · mixed

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a Laravel application image, exposing port 8000 on host port 8888. The included exploit script targets a Laravel debug RCE vulnerability (CVE-2021-3129) on the local service.

docker-compose.yml:1-7exploit.py:1-112

Lab assessment

Vulnerability lab

The repository name, README, and exploit script explicitly reference CVE-2021-3129 and provide a Python exploit that attacks a Laravel debug endpoint. The Docker Compose file builds a Laravel service, creating a contained target for the exploit.

README.md:1exploit.py:1-112
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

laravel_debug_rce

vulnerable target service

A service built from the local Dockerfile, tagged as vul/laravel_debug_rce, and exposed on host port 8888 mapping to container port 8000. It hosts the Laravel application that is the target of the exploit.

docker-compose.yml:3-7

exploit.py

exploit script

A Python3 script that sends crafted requests to the Laravel Ignition debug endpoint to achieve remote code execution. It uses PHPGGC to generate phar payloads and executes a command on the target.

exploit.py:1-112
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-3129

Supported by supplied evidence

The exploit script targets the Ignition execute-solution endpoint and uses log file manipulation to achieve RCE, consistent with the known CVE-2021-3129 vulnerability in Laravel debug mode.

exploit.py:1-112README.md:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the service.docker-compose.yml:1-7
  • Python3 and the requests library are required to run the exploit script.exploit.py:1-3
  • PHPGGC must be present to generate phar payloads for the exploit.exploit.py:8-10README.md:3

Evidence-described exercise path

  1. Start the vulnerable Laravel service with 'docker-compose up'.README.md:4
  2. Run the exploit script, which by default targets http://127.0.0.1:8888 and executes 'cat /etc/passwd'.exploit.py:110
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit script targets only the local lab service on 127.0.0.1:8888 and executes a harmless command ('cat /etc/passwd') by default. No behavior escapes the container, persists, steals credentials, or connects to external systems.

exploit.py:110docker-compose.yml:6
Review boundaries

What the analysis did not establish

  • The Dockerfile referenced in docker-compose.yml is not included in the evidence, so the exact build steps and any additional software installed are unknown.
  • The phpggc.zip and laravel.8.4.2.zip files are binary and uninspected; their contents and any potential hidden behavior are not assessed.
  • The exploit script uses os.system to execute shell commands for payload generation, which could be risky if the command input is not controlled, but the default command is benign.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

Repository root

Created Vuln labCVE-2021-3129Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a PHP 7.3.25 Alpine image with a Laravel application, installs Composer and the facade/ignition 2.5.1 package, and starts the Laravel development server on port 8000. The README and exploit.py script indicate this is a lab for CVE-2021-3129.

dockerfile:1-23README.md:1-7

Lab assessment

Vulnerability lab

The repository name, README, and exploit script explicitly target CVE-2021-3129, a known Laravel Ignition RCE vulnerability. The Dockerfile installs a specific vulnerable version of facade/ignition (2.5.1) and the exploit script implements a phar deserialization attack against the Ignition endpoint.

README.md:1dockerfile:12exploit.py:1-112
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the vulnerable Laravel target container

Uses php:7.3.25-alpine, copies a Laravel source directory, installs Composer from a remote URL, configures a Chinese mirror, runs composer install, requires facade/ignition 2.5.1, enables phar.readonly=0, exposes port 8000, and starts the Laravel development server.

dockerfile:1-23

exploit.py

exploit script for CVE-2021-3129

A Python3 script that targets the _ignition/execute-solution endpoint. It clears the Laravel log, generates a phar payload using phpggc, writes it to the log via a filter chain, decodes the log, and triggers phar deserialization to execute a system command. The main function targets http://127.0.0.1:8888 with 'cat /etc/passwd'.

exploit.py:1-112

phpggc.zip

PHP gadget chain generator (binary, uninspected)

A zip archive referenced by exploit.py to generate phar payloads. Its contents are not inspected; behavior is unknown beyond the command-line invocations in exploit.py.

exploit.py:8-10

laravel.8.4.2.zip

Laravel application source (binary, uninspected)

A zip archive copied into the Docker image as the Laravel application. Its contents are not inspected; it is assumed to contain a Laravel 8.4.2 installation.

dockerfile:3
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-3129

Supported by supplied evidence

The Dockerfile installs facade/ignition 2.5.1, a version known to be vulnerable to CVE-2021-3129. The exploit script implements the exact phar deserialization attack vector described for this CVE, targeting the _ignition/execute-solution endpoint.

dockerfile:12exploit.py:24-30exploit.py:55-65
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the Dockerfile.README.md:4
  • phpggc must be present and executable; the exploit script invokes it from a relative path phpggc/phpggc.exploit.py:8-10
  • The target Laravel application must be running and accessible at the URL specified in the exploit (default http://127.0.0.1:8888).exploit.py:110
  • Python3 with the requests library is required to run the exploit script.exploit.py:3

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.dockerfile:1-23
  2. Run the container, ensuring the Laravel development server is listening on port 8888 (as indicated in the README).README.md:5
  3. Generate a Laravel application key (as mentioned in the README).README.md:6
  4. Run exploit.py with the target URL and desired command. The script will attempt to exploit CVE-2021-3129 via phar deserialization and display the command output.exploit.py:110exploit.py:24-30exploit.py:55-65
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit script targets only the local lab container (http://127.0.0.1:8888) and executes a harmless proof-of-concept command (cat /etc/passwd). The Dockerfile does not contain any hidden or unnecessary instructions that would compromise the host or external systems. No persistence, credential theft, data destruction, or backdoor behavior is visible.

exploit.py:110dockerfile:1-23
Review boundaries

What the analysis did not establish

  • The docker-compose.yml file referenced in the README is not included in the evidence files; its contents are unknown.
  • The laravel.8.4.2.zip and phpggc.zip archives are binary and uninspected; their exact contents and any embedded behaviors are unknown.
  • The exploit script invokes phpggc via os.system, which could execute arbitrary commands if phpggc is compromised, but no evidence of compromise is present.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1