PT-2018-12889 · Laravel · Laravel Framework

Published 2018-08-09 · Updated 2025-07-15 · CVE-2018-15133

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Laravel Framework versions 5.5.0 through 5.5.40 Laravel Framework versions 5.6.0 through 5.6.29

Description Remote code execution might occur due to an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This issue involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Recommendations For Laravel Framework versions 5.5.0 through 5.5.40, update to a version later than 5.5.40 to resolve the issue. For Laravel Framework versions 5.6.0 through 5.6.29, update to a version later than 5.6.29 to resolve the issue. As a temporary workaround, consider restricting access to untrusted X-XSRF-TOKEN values until a patch is applied.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-15133

GHSA-QVQM-H22R-4CP9

Affected Products

Laravel Framework

References · 32

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb · Exploit
• 🔥 https://github.com/kozmic/laravel-poc-CVE-2018-15133 · Exploit
• 🔥 https://github.com/aljavier/exploit_laravel_cve-2018-15133 · Exploit
• 🔥 https://github.com/PwnedShell/Larascript · Exploit
• 🔥 https://github.com/pwnedshell/Larascript · Exploit
• 🔥 https://github.com/Prabesh01/Laravel-PHP-Unit-RCE-Auto-shell-uploader · Exploit
• 🔥 https://github.com/AzhariKun/CVE-2018-15133 · Exploit
• 🔥 http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/47129 · Exploit
• https://osv.dev/vulnerability/GHSA-qvqm-h22r-4cp9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15133 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15133 · Vendor Advisory
• https://github.com/laravel/framework · Note
• https://github.com/laravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083a0 · Note
• https://t.me/cvenotify/108381 · Telegram Post