In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a
    result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt
    method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php
    in phpggc. The attacker must know the application key, which normally would never occur, but could happen
    if the attacker previously had privileged access or successfully accomplished a previous attack.
    (CVE-2018-15133)

The version of Laravel Framework installed of the remote host is prior to 5.5.41 or 5.6.x prior to 5.6.30. It is, therefore, affected by a remote code execution vulnerability due to an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager, PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2018-15133 to check for backported fixes.

ID	Name	Product	Family	Type	Severity
432309	SCA: security update for laravel/framework (GHSA-qvqm-h22r-4cp9)	Tenable Cloud Security	SCA Checks	Local	high
432309	SCA: security update for laravel/framework (GHSA-qvqm-h22r-4cp9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
193333	Laravel Framework < 5.5.41 / 5.6.x < 5.6.30 RCE	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2018-15133

high

Tenable Plugins

high

high

high