CVE-2017-16894
HIGH EXPLOITED NUCLEILaravel <5.5.21 - Information Disclosure
Title source: nucleiExploitation Summary
CVE-2017-16894 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including Ståle Pettersen, aushack, including a Metasploit module exploits/unix/http/laravel_token_unserialize_exec.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a deserialization vulnerability in Laravel Framework versions 5.5.40 and 5.6.x <= 5.6.29 via a crafted X-XSRF-TOKEN header, allowing remote command execution. It includes methods to leak the APP_KEY and generate malicious serialized payloads.
Description
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.
Exploits (2)
This Metasploit module exploits a deserialization vulnerability in Laravel Framework versions 5.5.40 and 5.6.x <= 5.6.29 via a crafted X-XSRF-TOKEN header, allowing remote command execution. It includes methods to leak the APP_KEY and generate malicious serialized payloads.
This Metasploit module exploits a deserialization vulnerability in Laravel Framework (CVE-2017-16894) via a crafted X-XSRF-TOKEN header, allowing remote command execution if the APP_KEY is known or leaked. It includes multiple methods to leak the APP_KEY and generate malicious serialized payloads.
Nuclei Templates (1)
Laravel-Framework || cpe:"cpe:2.3:a:laravel:laravel" || laravel-framework
app="Laravel-Framework" || app="laravel-framework"
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N