CVE-2018-15133
Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.htmlExploitThird Party Advisory
- laravel.com/docs/5.6/upgradeVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 993 days
- CVSS
- 8.1 HIGH
- EPSS (30-day exploit probability)
- 76.6% · top 1% of all CVEs
- Weakness
- CWE-502
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.