CVE-2021-43617

This exploit demonstrates a bypass of Laravel's image upload functionality to upload arbitrary files, enabling XSS and CSRF token bypass. It uses a crafted HTML file with embedded JavaScript to extract and submit a CSRF token.

This repository demonstrates a proof-of-concept for CVE-2021-43617, which exploits a vulnerability in Laravel 8.70.1 where image file upload validation can be bypassed to upload arbitrary files, leading to XSS and CSRF token bypass.

This PoC generates a malicious PHAR file with a JPG header to exploit CVE-2021-43617, a deserialization vulnerability in Laravel. The script prepends a JPG magic header to a shell payload (e.g., Weevely) to bypass file upload restrictions.

This PoC demonstrates a basic file-based exploit by embedding an HTML payload into a JPEG file, but it lacks functional exploit code for CVE-2021-43617. The payload is a simple XSS alert, and the method does not align with the vulnerability's actual exploitation mechanism.