CVE-2017-16894 Information disclosure in n/a

What is CVE-2017-16894?

CVE-2017-16894 is a high-severity vulnerability in n/a, published on 20 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Weakness: CWE-200

Which versions are affected by CVE-2017-16894?

It affects 1 product.

Products include Laravel Laravel.

How do I fix CVE-2017-16894?

Apply the vendor's patch.

Is CVE-2017-16894 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-16894 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2018-15133 Laravel Deserialization of Untrusted Data Exploited High 8.1
• CVE-2021-28254 Deserialization in n/a Critical 9.8
• CVE-2020-24940 Guard bypass in Eloquent models affecting Laravel illuminate database component High 7.5
• CVE-2020-24941 Improper Input Validation in Laravel High 7.5
• CVE-2021-21263 Query Binding Exploitation in Laravel High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2v4r-7m2m-5chh.