Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to
    execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is
    exploitable on sites using debug mode with Laravel before 8.4.2. (CVE-2021-3129)

Facade Ignition is a customizable error page for Laravel applications running on Laravel 5.5 up to Laravel 8. It is the default error page for all Laravel 6 applications.

Facade Ignition versions prior to 2.5.2 is is affected by a vulnerability allowing an unauthenticated attacker to obtain Remote Code Execution via a specially forged request sequence.

The version of Facade Ignition installed of the remote host is prior to 1.16.14, or 2.x prior to 2.4.2, or 2.5.x prior to 2.5.2. It is, therefore, affected by a remote code execution vulnerability. Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager, PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for CVE-2021-3129 to check for backported fixes.

ID	Name	Product	Family	Type	Severity
410355	SCA: security update for facade/ignition (GHSA-4qwp-7c67-jmcc)	Tenable Cloud Security	SCA Checks	Local	critical
410355	SCA: security update for facade/ignition (GHSA-4qwp-7c67-jmcc)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
114388	Facade Ignition < 2.5.2 Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
194503	Facade Ignition < 1.16.14 / 2.x < 2.4.2 / 2.5.x < 2.5.2 RCE	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2021-3129

critical

Tenable Plugins

critical

critical

critical

critical