CVE-2018-15133
Laravel Deserialization of Untrusted Data Vulnerability
Description
CVE-2018-15133 is a high-severity remote code execution vulnerability in the Laravel PHP Framework affecting versions through 5.5.40 and 5.6.x through 5.6.29. The vulnerability arises from insecure deserialization of the X-XSRF-TOKEN HTTP header value: if an attacker possesses the application's encryption key, they can craft a malicious serialized payload that triggers arbitrary code execution when deserialized by the framework. The vulnerability carries a CVSS v3.1 score of 8.1 and an EPSS score of 0.860 (99th percentile), indicating a very high likelihood of exploitation. Despite its 2018 disclosure date, CISA added it to the Known Exploited Vulnerabilities catalog in 2024 with a remediation deadline of February 6, 2024, confirming continued active exploitation of legacy Laravel installations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| laravel | laravel | <= 5.5.40; >= 5.6.0, <= 5.6.29 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2018-15133 is classified under CWE-502: Deserialization of Untrusted Data. This weakness occurs when an application deserializes data from an untrusted source without adequate validation, allowing an attacker to manipulate the deserialization process to execute arbitrary code, bypass authentication, or alter application logic.
In Laravel's case, the X-XSRF-TOKEN header is decrypted and deserialized by the application. If an attacker possesses the application encryption key (APP_KEY), they can use PHP object serialization gadget chains — such as those provided by the phpggc tool (gadget chain Laravel/RCE/3/chain.php) — to construct a payload that, when deserialized, executes arbitrary operating system commands. The requirement to know the application key acts as a partial mitigation but does not prevent exploitation once that key is compromised.
Impact Analysis
Confidentiality Impact (HIGH): Successful remote code execution provides the attacker with full read access to all data accessible by the web server process, including the application source code, configuration files containing database credentials, API keys, and the Laravel APP_KEY itself.
Integrity Impact (HIGH): An attacker with code execution can modify files, databases, application code, and configurations. This enables persistent backdoor installation, data manipulation, and full application takeover.
Availability Impact (HIGH): The attacker can terminate services, corrupt data, or deploy destructive payloads that render the application completely unavailable.
Key Prerequisite — Application Key: The attack requires knowledge of the Laravel application encryption key (APP_KEY). The description notes this "normally would never occur" but can happen if the attacker previously had privileged access or successfully exploited a preceding vulnerability (e.g., file read, environment variable disclosure, or source code exposure). The high attack complexity (AC:H) reflects this key requirement.
Real-World Risk: Despite the key requirement, the EPSS score of 0.860 (99th percentile) and KEV listing confirm that exploitation is actively occurring. Attackers who obtain APP_KEY through initial access vectors (LFI, exposed .env files, source code repositories) subsequently leverage this vulnerability for RCE.
Exploit Maturity
Exploitation Status: CVE-2018-15133 is confirmed as actively exploited in the wild. Despite being disclosed in 2018, CISA added it to the Known Exploited Vulnerabilities catalog in 2024 with a February 6, 2024 remediation deadline, confirming ongoing exploitation of unpatched legacy Laravel installations.
EPSS Score: The EPSS score of 0.860 places this vulnerability in the 99th percentile (99.38%), indicating an exceptionally high statistical probability of exploitation relative to all known CVEs. This reflects the availability of public exploit code and the large number of unpatched Laravel deployments.
Exploit Tooling Available: Public exploit code exists, including ready-made gadget chains in the phpggc framework (specifically gadgetchains/Laravel/RCE/3/chain.php and related chains). A Metasploit module and PacketStorm exploit code are publicly documented, significantly lowering the technical barrier for exploitation.
Ransomware Association: The KEV entry records ransomware association as Unknown. No confirmed direct link to ransomware campaigns has been documented for this specific vulnerability.
Multi-Stage Attack Pattern: Exploitation typically follows a two-stage pattern: first, the attacker obtains the Laravel APP_KEY (via exposed .env file, local file inclusion, or other means), then crafts a malicious deserialization payload targeting the X-XSRF-TOKEN header.
Remediation
- Upgrade Laravel Framework immediately: Update to Laravel 5.5.41 or later (for the 5.5.x branch) or 5.6.30 or later (for the 5.6.x branch), as documented in the Laravel 5.6 upgrade guide. Newer major versions of Laravel (8.x, 9.x, 10.x, 11.x) do not have this vulnerability.
- Protect the APP_KEY from disclosure: Ensure the Laravel .env file containing APP_KEY is never exposed via web server misconfiguration, local file inclusion vulnerabilities, or public code repositories. Rotate the APP_KEY immediately if any exposure is suspected.
- Audit for .env file exposure: Verify that your web server configuration denies public HTTP access to the .env file and all files in the Laravel root directory outside the public/ folder.
- Rotate the APP_KEY if compromise is suspected: If the APP_KEY may have been exposed, regenerate it using php artisan key:generate. Be aware that this will invalidate all encrypted cookies and sessions.
- Review version control history: Check that the APP_KEY and .env files have never been committed to Git repositories, including private repositories that may have been compromised or made public.
- Apply web application firewall rules: Deploy WAF rules to detect and block malicious serialized payloads in the X-XSRF-TOKEN header as a defense-in-depth measure.
- Audit legacy deployments: Inventory all Laravel applications in your environment, particularly older or unmaintained deployments, and prioritize upgrading any that fall within the affected version range.
Technical Details
Vulnerability Class: Insecure deserialization of untrusted data (CWE-502) via the X-XSRF-TOKEN HTTP header in the Laravel PHP Framework.
Affected Versions: Laravel Framework versions through 5.5.40 and 5.6.x through 5.6.29.
Attack Vector: Network (AV:N) — remotely exploitable by sending a crafted HTTP request containing a malicious serialized payload in the X-XSRF-TOKEN header.
Attack Complexity: High (AC:H) — exploitation requires prior knowledge of the Laravel application encryption key (APP_KEY).
Mechanism: Laravel's Illuminate/Encryption/Encrypter.php decrypt() method is called on the X-XSRF-TOKEN header value. If the decrypted value is a valid PHP serialized string and the token is encrypted with the known APP_KEY, the PHP unserialize() call can trigger gadget chain execution. The phpggc tool provides pre-built Laravel gadget chains (e.g., Laravel/RCE/3/chain.php via PendingBroadcast) that enable arbitrary command execution when deserialized in the Laravel context.
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE Classification: CWE-502 (Deserialization of Untrusted Data)
Fixed Versions: Laravel 5.5.41+ and 5.6.30+ (see Laravel 5.6 upgrade documentation). The fix modifies the handling of the X-XSRF-TOKEN to prevent deserialization of untrusted user-supplied content.
Frequently Asked Questions
Does an attacker need the Laravel APP_KEY to exploit CVE-2018-15133?
Yes. Exploitation requires that the attacker knows the Laravel application encryption key (APP_KEY). This key is used to encrypt the X-XSRF-TOKEN, and the attacker must encrypt their malicious serialized payload with the same key for it to be accepted by the application. While this is a prerequisite, APP_KEYs are frequently exposed through .env file leaks, local file inclusion vulnerabilities, public Git repositories, or prior system compromise — all of which are observed attack patterns in the wild.
Why is a 2018 vulnerability still being actively exploited in 2024?
Despite being disclosed in 2018, many organizations run legacy Laravel applications that have not been updated. Older web applications may no longer receive active maintenance, or upgrading may be deprioritized due to application compatibility concerns. The availability of public exploit tooling (phpggc, Metasploit modules, PacketStorm exploits) and the large installed base of unpatched Laravel applications make this an attractive target for attackers. CISA's 2024 KEV listing reflects confirmed ongoing exploitation.
Can this vulnerability be exploited without any prior access?
Exploitation requires the Laravel APP_KEY, so it is not a zero-knowledge attack. However, the EPSS score of 0.860 (99th percentile) reflects the high practical exploitability — attackers frequently chain this vulnerability with other weaknesses (such as .env file disclosure or LFI) to first obtain the key, then leverage CVE-2018-15133 for code execution. Organizations must treat APP_KEY exposure as a critical prerequisite risk.
Which Laravel versions are not affected by CVE-2018-15133?
Laravel 5.5.41 and later (in the 5.5.x branch) and 5.6.30 and later (in the 5.6.x branch) include the fix for this vulnerability. All current major versions of Laravel (8.x, 9.x, 10.x, 11.x) do not contain this vulnerability. Organizations should upgrade to the latest supported major release of Laravel to benefit from security fixes, ongoing support, and modern security practices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.