漏洞描述
Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.ambionics.iohttps://www.ambionics.io/blog/laravel-debug-rce↗github.comhttps://github.com/vulhub/vulhub/tree/master/laravel/CVE-2021-3129↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-3129↗github.comhttps://github.com/facade/ignition/pull/334↗github.comhttps://github.com/d4n-sec/d4n-sec.github.io↗