CVE-2021-3129
Laravel Ignition File Upload Vulnerability
Description
CVE-2021-3129 is a critical remote code execution vulnerability in Ignition before version 2.5.2, the error page handler used by the Laravel PHP framework. The vulnerability allows unauthenticated remote attackers to execute arbitrary code due to insecure usage of file_get_contents() and file_put_contents() functions when debug mode is enabled. CVE-2021-3129 is exploitable on Laravel applications running debug mode with Laravel versions before 8.4.2, making it a significant threat to web applications in production that inadvertently have debugging enabled. CISA has confirmed active exploitation of this Laravel Ignition vulnerability, including use in ransomware campaigns, and its EPSS score of 94.3% places it in the 99th percentile for exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| facade | ignition | < 2.5.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/facade/ignition/pull/334(Patch, Third Party Advisory)
- https://www.ambionics.io/blog/laravel-debug-rce(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2021-3129 in the NVD database. The vulnerability stems from insecure file handling in the Ignition error page component, where the file_get_contents() and file_put_contents() functions are used without adequate security controls, enabling an unauthenticated attacker to achieve remote code execution through crafted requests when debug mode is active.
Learn more: CWE Overview
Impact Analysis
CVE-2021-3129 carries a CVSS v3.1 score of 9.8 (Critical), reflecting the most severe exploitability characteristics. The vulnerability is remotely exploitable without physical access via the network, is easy to exploit with no special conditions needed, requires no authentication, and requires no user interaction — making it trivially exploitable by any attacker who can reach the application. Confidentiality (High): Successful exploitation grants the attacker access to all data accessible by the web application, including database credentials, configuration files, and user data. Integrity (High): Remote code execution enables the attacker to modify application code, inject backdoors, and alter data. Availability (High): The attacker can disrupt services, deploy ransomware, or completely take over the server. CISA has confirmed that this vulnerability has been used in ransomware campaigns, and with an EPSS score of 94.3%, exploitation is near-certain for exposed instances.
Exploit Maturity
Public exploit code is available for CVE-2021-3129 via multiple sources including Packet Storm Security (Ignition 2.5.1 RCE), Packet Storm Security (Ignition RCE), and a detailed technical writeup by Ambionics. CISA has confirmed active exploitation of this Laravel Ignition vulnerability in the wild, with confirmed use in ransomware operations, making it an immediate threat to any Laravel application running debug mode. The EPSS score of 94.3% indicates near-certain exploitation activity, placing CVE-2021-3129 in the 99th percentile for exploitation probability.
Remediation
- Apply mitigations per vendor instructions or discontinue use of vulnerable Ignition versions as directed by CISA (remediation deadline: October 9, 2023). Update Ignition to version 2.5.2 or later, which patches the insecure file handling functions.
- Upgrade Laravel to version 8.4.2 or later, which includes the patched Ignition dependency. Verify the update by checking the Ignition version in your composer.lock file and confirming it is 2.5.2 or above. Review the fix pull request on GitHub for details on the patch.
- Disable debug mode immediately on all production Laravel applications by setting APP_DEBUG=false in the .env configuration file. Debug mode should never be enabled in production environments as it exposes sensitive error information and enables the vulnerable code paths.
- Review server logs for indicators of compromise, including unusual requests to Ignition endpoints, unexpected file modifications (particularly in storage and bootstrap/cache directories), and signs of web shell deployment. Check for unauthorized outbound connections that may indicate ransomware staging.
- Implement defense-in-depth measures by restricting access to the application's debug endpoints using web application firewall rules, ensuring the web server process runs with minimal file system privileges, and implementing file integrity monitoring to detect unauthorized changes to application files.
Technical Details
CVE-2021-3129 exploits a design flaw in the Ignition error page handler (before version 2.5.2), which is the default error display component in Laravel. When debug mode is enabled (APP_DEBUG=true), Ignition exposes endpoints that use PHP's file_get_contents() and file_put_contents() functions in an insecure manner, allowing an unauthenticated attacker to read and write arbitrary files on the server. By chaining these file operations, an attacker can achieve remote code execution, for example by modifying the application's log file and leveraging PHP's phar:// stream wrapper for deserialization attacks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms this is a network-accessible vulnerability with low complexity, requiring no privileges or user interaction, resulting in complete system compromise. The vulnerability is particularly dangerous because many Laravel applications are deployed with debug mode inadvertently left enabled in production.
Frequently Asked Questions
Is CVE-2021-3129 being actively exploited?
Yes, CVE-2021-3129 is actively exploited in the wild. CISA has included it in the Known Exploited Vulnerabilities catalog and confirmed its use in ransomware campaigns. The EPSS score of 94.3% indicates near-certain exploitation activity, making immediate remediation critical for any affected Laravel deployment.
What products are affected by CVE-2021-3129?
CVE-2021-3129 affects Ignition versions before 2.5.2, which is the error page handler component used by the Laravel PHP framework. The vulnerability is exploitable on sites running debug mode with Laravel versions before 8.4.2. Any web application using the Facade Ignition package in these version ranges is potentially vulnerable.
How do I fix CVE-2021-3129?
Update Ignition to version 2.5.2 or later and Laravel to version 8.4.2 or later. As an immediate mitigation, disable debug mode on all production environments by setting APP_DEBUG=false in your .env file. Refer to the Remediation section for detailed steps including log review and defense-in-depth measures.
How severe is CVE-2021-3129?
CVE-2021-3129 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It allows unauthenticated remote code execution and is in the 99th percentile for exploitation probability with an EPSS score of 94.3%. The confirmed use in ransomware campaigns and the availability of multiple public exploits make this an extremely high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.