CVE-2021-3129 Laravel Ignition File Upload

What is CVE-2021-3129?

CVE-2021-3129 is a critical code injection vulnerability in n/a, published on 12 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Which versions are affected by CVE-2021-3129?

8 open source packages ship an affected version, including facade/ignition. It affects 1 product.

Products include Facade Ignition.

How do I fix CVE-2021-3129?

Upgrade facade/ignition to a fixed version for your release line: 1.6.15, 1.16.14, 2.4.2 or 2.5.2. US federal agencies must fix it by 9 Oct 2023.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-3129 being exploited?

Yes. Attackers have exploited CVE-2021-3129 in the wild since at least 18 Sep 2023, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 33 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-43996 Incorrect Access Control in Ignition Critical 9.8
• CVE-2020-13909 Critical severity vulnerability in Ignition Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4qwp-7c67-jmcc.