CVE-2017-16894: Infoleak
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses fileputcontents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16894?
CVE-2017-16894 is categorized as severe due to its potential for exposing sensitive environment variables.
How do I fix CVE-2017-16894?
To fix CVE-2017-16894, ensure that the /.env file is not publicly accessible by implementing proper web server configurations.
Which versions of Laravel are affected by CVE-2017-16894?
CVE-2017-16894 affects all Laravel framework versions up to and including 5.5.21.
What kind of information can be leaked through CVE-2017-16894?
CVE-2017-16894 can leak sensitive information such as passwords and other environmental variables.
Are there any mitigation steps for CVE-2017-16894?
Mitigation steps for CVE-2017-16894 include securing access to the service and restricting access to sensitive files.