CVE-2021-3129: Laravel Ignition File Upload Vulnerability
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of filegetcontents() and fileputcontents().
Other sources
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents() and fileputcontents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Laravel Ignitionto a version that resolves this vulnerability.Fixed in 8.4.2 - Configuration
Disable debug mode on sites using Laravel Ignition; the remote code execution is exploitable on sites using debug mode with Laravel before 8.4.2.
Laravel (debug mode) debug mode = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3129?
CVE-2021-3129 is considered a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2021-3129?
To fix CVE-2021-3129, upgrade Ignition to version 2.5.2 or later.
Who is affected by CVE-2021-3129?
CVE-2021-3129 affects versions of Ignition prior to 2.5.2.
What type of vulnerability is CVE-2021-3129?
CVE-2021-3129 is a file upload vulnerability that can lead to remote code execution.
Can unauthenticated users exploit CVE-2021-3129?
Yes, CVE-2021-3129 can be exploited by unauthenticated remote attackers.