Laravel Framework RCE Vulnerability
The advisory, in context
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 5.5.40 (inclusive)
No fix recorded for this interval.
312 explicitly affected versions
5.0.30, 5.2.41, v4.0.0, v4.0.0-BETA2, v4.0.0-BETA3, v4.0.0-BETA4, v4.0.1, v4.0.10, v4.0.11, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.1, v4.1.10, v4.1.11, v4.1.12, v4.1.13, v4.1.14, v4.1.15, v4.1.16, v4.1.17, v4.1.18, v4.1.19, v4.1.2, v4.1.20, v4.1.21, v4.1.22, v4.1.23, v4.1.24, v4.1.25, v4.1.26, v4.1.27, v4.1.28, v4.1.29, v4.1.3, v4.1.30, v4.1.31, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9, v4.2.0, v4.2.0-BETA1, v4.2.1, v4.2.10, v4.2.11, v4.2.12, v4.2.13, v4.2.14, v4.2.15, v4.2.16, v4.2.17, v4.2.18, v4.2.19, v4.2.2, v4.2.20, v4.2.21, v4.2.22, v4.2.3, v4.2.4, v4.2.5, v4.2.6, v4.2.7, v4.2.8, v4.2.9, v5.0.0, v5.0.1, v5.0.10, v5.0.11, v5.0.12, v5.0.13, v5.0.14, v5.0.15, v5.0.16, v5.0.17, v5.0.18, v5.0.19, v5.0.2, v5.0.20, v5.0.21, v5.0.22, v5.0.23, v5.0.24, v5.0.25, v5.0.26, v5.0.27, v5.0.28, v5.0.29, v5.0.3, v5.0.31, v5.0.32, v5.0.33, v5.0.34, v5.0.35, v5.0.4, v5.0.5, v5.0.6, v5.0.7, v5.0.8, v5.0.9, v5.1.0, v5.1.1, v5.1.10, v5.1.11, v5.1.12, v5.1.13, v5.1.14, v5.1.15, v5.1.16, v5.1.17, v5.1.18, v5.1.19, v5.1.2, v5.1.20, v5.1.21, v5.1.22, v5.1.23, v5.1.24, v5.1.25, v5.1.26, v5.1.27, v5.1.28, v5.1.29, v5.1.3, v5.1.30, v5.1.31, v5.1.32, v5.1.33, v5.1.34, v5.1.35, v5.1.36, v5.1.37, v5.1.38, v5.1.39, v5.1.4, v5.1.40, v5.1.41, v5.1.42, v5.1.43, v5.1.44, v5.1.45, v5.1.46, v5.1.5, v5.1.6, v5.1.7, v5.1.8, v5.1.9, v5.2.0, v5.2.0-beta1, v5.2.1, v5.2.10, v5.2.11, v5.2.12, v5.2.13, v5.2.14, v5.2.15, v5.2.16, v5.2.17, v5.2.18, v5.2.19, v5.2.2, v5.2.20, v5.2.21, v5.2.22, v5.2.23, v5.2.24, v5.2.25, v5.2.26, v5.2.27, v5.2.28, v5.2.29, v5.2.3, v5.2.30, v5.2.31, v5.2.32, v5.2.33, v5.2.34, v5.2.35, v5.2.36, v5.2.37, v5.2.38, v5.2.39, v5.2.4, v5.2.40, v5.2.42, v5.2.43, v5.2.44, v5.2.45, v5.2.5, v5.2.6, v5.2.7, v5.2.8, v5.2.9, v5.3.0, v5.3.0-RC1, v5.3.1, v5.3.10, v5.3.11, v5.3.12, v5.3.13, v5.3.14, v5.3.15, v5.3.16, v5.3.17, v5.3.18, v5.3.19, v5.3.2, v5.3.20, v5.3.21, v5.3.22, v5.3.23, v5.3.24, v5.3.25, v5.3.26, v5.3.27, v5.3.28, v5.3.29, v5.3.3, v5.3.30, v5.3.31, v5.3.4, v5.3.5, v5.3.6, v5.3.7, v5.3.8, v5.3.9, v5.4.0, v5.4.1, v5.4.10, v5.4.11, v5.4.12, v5.4.13, v5.4.14, v5.4.15, v5.4.16, v5.4.17, v5.4.18, v5.4.19, v5.4.2, v5.4.20, v5.4.21, v5.4.22, v5.4.23, v5.4.24, v5.4.25, v5.4.26, v5.4.27, v5.4.28, v5.4.29, v5.4.3, v5.4.30, v5.4.31, v5.4.32, v5.4.33, v5.4.34, v5.4.35, v5.4.36, v5.4.4, v5.4.5, v5.4.6, v5.4.7, v5.4.8, v5.4.9, v5.5.0, v5.5.1, v5.5.10, v5.5.11, v5.5.12, v5.5.13, v5.5.14, v5.5.15, v5.5.16, v5.5.17, v5.5.18, v5.5.19, v5.5.2, v5.5.20, v5.5.21, v5.5.22, v5.5.23, v5.5.24, v5.5.25, v5.5.26, v5.5.27, v5.5.28, v5.5.29, v5.5.3, v5.5.30, v5.5.31, v5.5.32, v5.5.33, v5.5.34, v5.5.35, v5.5.36, v5.5.37, v5.5.38, v5.5.39, v5.5.4, v5.5.40, v5.5.5, v5.5.6, v5.5.7, v5.5.8, v5.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.5.40"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.30",
"5.2.41",
"v4.0.0",
"v4.0.0-BETA2",
"v4.0.0-BETA3",
"v4.0.0-BETA4",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.12",
"v4.1.13",
"v4.1.14",
"v4.1.15",
"v4.1.16",
"v4.1.17",
"v4.1.18",
"v4.1.19",
"v4.1.2",
"v4.1.20",
"v4.1.21",
"v4.1.22",
"v4.1.23",
"v4.1.24",
"v4.1.25",
"v4.1.26",
"v4.1.27",
"v4.1.28",
"v4.1.29",
"v4.1.3",
"v4.1.30",
"v4.1.31",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9",
"v4.2.0",
"v4.2.0-BETA1",
"v4.2.1",
"v4.2.10",
"v4.2.11",
"v4.2.12",
"v4.2.13",
"v4.2.14",
"v4.2.15",
"v4.2.16",
"v4.2.17",
"v4.2.18",
"v4.2.19",
"v4.2.2",
"v4.2.20",
"v4.2.21",
"v4.2.22",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6",
"v4.2.7",
"v4.2.8",
"v4.2.9",
"v5.0.0",
"v5.0.1",
"v5.0.10",
"v5.0.11",
"v5.0.12",
"v5.0.13",
"v5.0.14",
"v5.0.15",
"v5.0.16",
"v5.0.17",
"v5.0.18",
"v5.0.19",
"v5.0.2",
"v5.0.20",
"v5.0.21",
"v5.0.22",
"v5.0.23",
"v5.0.24",
"v5.0.25",
"v5.0.26",
"v5.0.27",
"v5.0.28",
"v5.0.29",
"v5.0.3",
"v5.0.31",
"v5.0.32",
"v5.0.33",
"v5.0.34",
"v5.0.35",
"v5.0.4",
"v5.0.5",
"v5.0.6",
"v5.0.7",
"v5.0.8",
"v5.0.9",
"v5.1.0",
"v5.1.1",
"v5.1.10",
"v5.1.11",
"v5.1.12",
"v5.1.13",
"v5.1.14",
"v5.1.15",
"v5.1.16",
"v5.1.17",
"v5.1.18",
"v5.1.19",
"v5.1.2",
"v5.1.20",
"v5.1.21",
"v5.1.22",
"v5.1.23",
"v5.1.24",
"v5.1.25",
"v5.1.26",
"v5.1.27",
"v5.1.28",
"v5.1.29",
"v5.1.3",
"v5.1.30",
"v5.1.31",
"v5.1.32",
"v5.1.33",
"v5.1.34",
"v5.1.35",
"v5.1.36",
"v5.1.37",
"v5.1.38",
"v5.1.39",
"v5.1.4",
"v5.1.40",
"v5.1.41",
"v5.1.42",
"v5.1.43",
"v5.1.44",
"v5.1.45",
"v5.1.46",
"v5.1.5",
"v5.1.6",
"v5.1.7",
"v5.1.8",
"v5.1.9",
"v5.2.0",
"v5.2.0-beta1",
"v5.2.1",
"v5.2.10",
"v5.2.11",
"v5.2.12",
"v5.2.13",
"v5.2.14",
"v5.2.15",
"v5.2.16",
"v5.2.17",
"v5.2.18",
"v5.2.19",
"v5.2.2",
"v5.2.20",
"v5.2.21",
"v5.2.22",
"v5.2.23",
"v5.2.24",
"v5.2.25",
"v5.2.26",
"v5.2.27",
"v5.2.28",
"v5.2.29",
"v5.2.3",
"v5.2.30",
"v5.2.31",
"v5.2.32",
"v5.2.33",
"v5.2.34",
"v5.2.35",
"v5.2.36",
"v5.2.37",
"v5.2.38",
"v5.2.39",
"v5.2.4",
"v5.2.40",
"v5.2.42",
"v5.2.43",
"v5.2.44",
"v5.2.45",
"v5.2.5",
"v5.2.6",
"v5.2.7",
"v5.2.8",
"v5.2.9",
"v5.3.0",
"v5.3.0-RC1",
"v5.3.1",
"v5.3.10",
"v5.3.11",
"v5.3.12",
"v5.3.13",
"v5.3.14",
"v5.3.15",
"v5.3.16",
"v5.3.17",
"v5.3.18",
"v5.3.19",
"v5.3.2",
"v5.3.20",
"v5.3.21",
"v5.3.22",
"v5.3.23",
"v5.3.24",
"v5.3.25",
"v5.3.26",
"v5.3.27",
"v5.3.28",
"v5.3.29",
"v5.3.3",
"v5.3.30",
"v5.3.31",
"v5.3.4",
"v5.3.5",
"v5.3.6",
"v5.3.7",
"v5.3.8",
"v5.3.9",
"v5.4.0",
"v5.4.1",
"v5.4.10",
"v5.4.11",
"v5.4.12",
"v5.4.13",
"v5.4.14",
"v5.4.15",
"v5.4.16",
"v5.4.17",
"v5.4.18",
"v5.4.19",
"v5.4.2",
"v5.4.20",
"v5.4.21",
"v5.4.22",
"v5.4.23",
"v5.4.24",
"v5.4.25",
"v5.4.26",
"v5.4.27",
"v5.4.28",
"v5.4.29",
"v5.4.3",
"v5.4.30",
"v5.4.31",
"v5.4.32",
"v5.4.33",
"v5.4.34",
"v5.4.35",
"v5.4.36",
"v5.4.4",
"v5.4.5",
"v5.4.6",
"v5.4.7",
"v5.4.8",
"v5.4.9",
"v5.5.0",
"v5.5.1",
"v5.5.10",
"v5.5.11",
"v5.5.12",
"v5.5.13",
"v5.5.14",
"v5.5.15",
"v5.5.16",
"v5.5.17",
"v5.5.18",
"v5.5.19",
"v5.5.2",
"v5.5.20",
"v5.5.21",
"v5.5.22",
"v5.5.23",
"v5.5.24",
"v5.5.25",
"v5.5.26",
"v5.5.27",
"v5.5.28",
"v5.5.29",
"v5.5.3",
"v5.5.30",
"v5.5.31",
"v5.5.32",
"v5.5.33",
"v5.5.34",
"v5.5.35",
"v5.5.36",
"v5.5.37",
"v5.5.38",
"v5.5.39",
"v5.5.4",
"v5.5.40",
"v5.5.5",
"v5.5.6",
"v5.5.7",
"v5.5.8",
"v5.5.9"
]
}From 5.6.0 before 5.6.30
Fixed in 5.6.30
30 explicitly affected versions
v5.6.0, v5.6.1, v5.6.10, v5.6.11, v5.6.12, v5.6.13, v5.6.14, v5.6.15, v5.6.16, v5.6.17, v5.6.18, v5.6.19, v5.6.2, v5.6.20, v5.6.21, v5.6.22, v5.6.23, v5.6.24, v5.6.25, v5.6.26, v5.6.27, v5.6.28, v5.6.29, v5.6.3, v5.6.4, v5.6.5, v5.6.6, v5.6.7, v5.6.8, v5.6.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.6.0"
},
{
"fixed": "5.6.30"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v5.6.0",
"v5.6.1",
"v5.6.10",
"v5.6.11",
"v5.6.12",
"v5.6.13",
"v5.6.14",
"v5.6.15",
"v5.6.16",
"v5.6.17",
"v5.6.18",
"v5.6.19",
"v5.6.2",
"v5.6.20",
"v5.6.21",
"v5.6.22",
"v5.6.23",
"v5.6.24",
"v5.6.25",
"v5.6.26",
"v5.6.27",
"v5.6.28",
"v5.6.29",
"v5.6.3",
"v5.6.4",
"v5.6.5",
"v5.6.6",
"v5.6.7",
"v5.6.8",
"v5.6.9"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2018-15133
- https://github.com/laravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083a0
- https://github.com/kozmic/laravel-poc-CVE-2018-15133
- https://github.com/laravel/framework
- https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
- http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html