flame-11/CVE-2018-15133-laravel-framework

GitHubRepository PoCScanner

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Docker-based lab environment for CVE-2018-15133, designed to be used with an external scanner (e.g., Nuclei) to validate the vulnerability. It does not contain exploit code itself.

Backdoor review

No backdoor observed in reviewed code

The repository is a Docker-based lab for CVE-2018-15133. All reviewed text files (Dockerfile, README.md, routes/web.php) describe or implement a vulnerable Laravel application setup and a benign POST route. No concealed executable behavior, credential theft, persistence, or unrelated payload is present in the supplied evidence.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesDockerfilePHPMarkdown
Target softwareLaravel Framework
Attack typesDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary purpose is to provide a vulnerable target for validation. The README explicitly states it is a 'Vulnerable Lab' and instructs users to 'Use any PoC that crafts a Laravel-encrypted X-XSRF-TOKEN' or a 'Nuclei template for CVE-2018-15133' to validate the vulnerability. The provided code (Dockerfile, routes) only sets up the environment and does not contain any exploit or scanning logic itself. This makes it a scanner support component, classified as a scanner.

README.md:1README.md:23README.md:28-33

Requirements

  • The attacker must know the application's APP_KEY.README.md:18-19

Observed behavior

  • Sets up a vulnerable Laravel 5.6.29 application with a known APP_KEY.Dockerfile:3Dockerfile:41README.md:18-19
  • Exposes a POST route at '/poc' to trigger CSRF token parsing.routes/web.php:11-13
  • Instructs users to run an external Nuclei scanner template against the lab to validate the vulnerability.README.md:23README.md:28-33
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Fixed App Key
base64:C9keXyMoHkA4Rg40PHuuZakLSC5rpOF7myjb876DQv0=The README discloses a known APP_KEY used by the lab, which is required for the CVE-2018-15133 exploit scenario. This is a deliberate lab configuration, not a backdoor.README.md:19
Vulnerable Application Setup
Laravel 5.6.29 with a POST /poc route under web middlewareThe Dockerfile installs a vulnerable Laravel version and the routes file defines a POST route that triggers CSRF handling, consistent with the CVE-2018-15133 description. This is the intended lab behavior.Dockerfile:41routes/web.php:11-13
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are included. The omitted files (e.g., env.example, docker-compose.yml) are not provided for analysis.
  • The artifact itself does not contain any exploit or scanner code; it is a lab environment. The classification is based on its stated purpose in the README.
  • Three additional files (env.example, docker-compose.yml, and one other) are present in the repository but were not included in the text evidence. Their content is unknown.
  • Binary files were not analyzed per the evidence policy.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2018-15133Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment that builds a PHP 7.2 Apache container running a pinned Laravel 5.6.29 application with a known APP_KEY, intended as a reproducible lab for CVE-2018-15133.

docker-compose.yml:1-13Dockerfile:1-57README.md:1-41

Lab assessment

Vulnerability lab

The README explicitly states the repository provides a reproducible Docker lab for CVE-2018-15133, the Dockerfile pins a vulnerable Laravel version, and a POST route is added to trigger CSRF parsing required for the exploit.

README.md:1-3Dockerfile:1Dockerfile:42-44routes/web.php:1-15
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

laravel

vulnerable target applicationApache web serverPHP 7.2 runtime

A container built from php:7.2.34-apache, configured with Laravel 5.6.29 and a known APP_KEY. It serves a POST /poc route under the web middleware group to trigger CSRF token parsing, which is the attack vector for CVE-2018-15133.

docker-compose.yml:4-10Dockerfile:1Dockerfile:42-44Dockerfile:55-56routes/web.php:1-15env.example:1-17
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2018-15133

Supported by supplied evidence

The lab explicitly targets CVE-2018-15133, pins a vulnerable Laravel framework version (5.6.29), provides a known APP_KEY, and includes a POST route that triggers CSRF token unserialization, which is the documented attack vector.

README.md:1-3Dockerfile:42-44env.example:3routes/web.php:10-12
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:9-11
  • The attacker must know the APP_KEY (provided in env.example) to craft a malicious encrypted X-XSRF-TOKEN.README.md:15-17env.example:3
  • A proof-of-concept tool (e.g., Nuclei with CVE-2018-15133 template) is needed to send the crafted payload to the /poc endpoint.README.md:19-29

Evidence-described exercise path

  1. Build and start the lab with 'docker compose up -d --build'.README.md:9-11
  2. Verify the lab is running by accessing http://localhost:18088/.README.md:13-14
  3. Use a PoC (e.g., Nuclei) to send a crafted X-XSRF-TOKEN to the /poc POST endpoint, exploiting the unserialize vulnerability with the known APP_KEY.README.md:19-29
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. It maps port 18088 to the container's port 80 for local access, does not use privileged mode, mount host filesystems, or connect to external systems. All visible behavior is directed at the lab's own target application.

docker-compose.yml:1-13Dockerfile:1-57
Review boundaries

What the analysis did not establish

  • The packet does not include the actual exploit payload or proof-of-concept code; only the lab infrastructure is provided.
  • The Dockerfile fetches external resources (archive.debian.org, getcomposer.org) during build, which is expected for a lab but could be a supply chain risk if those sources are compromised.
  • The .gitignore file is not included in evidence_files, but its absence does not affect the analysis.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1