CVE-2021-3129: Unauthenticated remote code execution in Ignition
(updated )
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/facade/ignition/CVE-2021-3129.yaml
- github.com/advisories/GHSA-4qwp-7c67-jmcc
- github.com/facade/ignition
- github.com/facade/ignition/commit/11ffca14abd22db779d90b12e193f8000f6d184b
- github.com/facade/ignition/pull/334
- nvd.nist.gov/vuln/detail/CVE-2021-3129
- www.ambionics.io/blog/laravel-debug-rce
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129
Code Behaviors & Features
Detect and mitigate CVE-2021-3129 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →