onyx --cves cve-2018-15133
CVE-2018-15133
- score
- <0.1
- cvss
- 8.1
- epss
- 76.6%
- published
- 2018-08-09
- kev added
- 2024-01-16
- first seen
Laravel Framework versions 5.5.40 and 5.6.x through 5.6.29 contain a remote code execution caused by unserialize call on untrusted X-XSRF-TOKEN value in Encrypter.php and phpggc gadgetchains, letting attackers with prior access execute arbitrary code, exploit requires attacker to know the application key.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
- Public PoC http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html
Exploit availability
Weaknesses
References 11
- https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
- https://nvd.nist.gov/vuln/detail/CVE-2018-15133
- https://falconfeeds.io/blogs/proxy-networks-and-the-rise-of-disposable-iaas
- https://www.synacktiv.com/en/publications/laravel-appkey-leakage-analysis
- https://isc.sans.edu/diary/Who%20You%20Gonna%20Call%3F%20AndroxGh0st%20Busters!%20%5BGuest%20Diary%5D/31086
- https://www.fortiguard.com/outbreak-alert/androxgh0st-malware
- https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave
- https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf
- https://blogs.juniper.net/en-us/security/shielding-networks-against-androxgh0st
- http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133