CVE-2021-3129

Name of the Vulnerable Software and Affected Versions Laravel versions prior to 8.4.2 Ignition versions prior to 2.5.2

Description The issue is related to insecure usage of

file get contents()

and

file put contents()

in the Ignition library used by Laravel. This allows unauthenticated remote attackers to execute arbitrary code when debug mode is enabled. The vulnerability is exploitable on sites using Laravel before version 8.4.2. It has been reported that this issue is being actively exploited, with attackers targeting cloud-hosted large language model services by leveraging stolen cloud credentials.

Recommendations For Laravel versions prior to 8.4.2, update to version 8.4.2 or later to resolve the issue. For Ignition versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider disabling debug mode in Laravel until a patch is applied. Restrict access to the Ignition module to minimize the risk of exploitation.