knqyf263/CVE-2021-3129

PoC for CVE-2021-3129 (Laravel)

CVE-2021-3129

PoC for CVE-2021-3129 (Laravel)

For educational purposes only

Test

Set up the PoC environment

$ docker-compose build
$ docker-compose up -d

Confirm it works

See http://localhost:8000/ and make sure the Laravel default page is shown.

Exploit

$ docker-compose exec attacker sh
/ # python3 exploit.py

References

• https://www.ambionics.io/blog/laravel-debug-rce
• https://github.com/SNCKER/CVE-2021-3129

Author

Teppei Fukuda