CVE-2018-15133 Laravel Deserialization of Untrusted Data

What is CVE-2018-15133?

CVE-2018-15133 is a high-severity unsafe deserialization vulnerability in n/a, published on 9 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Weakness: CWE-502

Which versions are affected by CVE-2018-15133?

4 open source packages ship an affected version, including laravel/framework. It affects 1 product.

Products include Laravel Laravel.

How do I fix CVE-2018-15133?

Upgrade laravel/framework to 5.6.30 or later. US federal agencies must fix it by 6 Feb 2024.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-15133 being exploited?

Yes. Attackers have exploited CVE-2018-15133 in the wild since at least 16 Jan 2024.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 14 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-28254 Deserialization in n/a Critical 9.8
• CVE-2020-24940 Guard bypass in Eloquent models affecting Laravel illuminate database component High 7.5
• CVE-2020-24941 Improper Input Validation in Laravel High 7.5
• CVE-2017-16894 Information disclosure in n/a High 7.5
• CVE-2021-21263 Query Binding Exploitation in Laravel High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qvqm-h22r-4cp9.