Laravel Ignition RCE (CVE-2021-3129)

Ignition is the interactive error page Laravel shows in development. CVE-2021-3129 affects Laravel <= 8.4.2 with Ignition < 2.5.2 when debug mode is on (APP_DEBUG=true): the /_ignition/execute-solution endpoint lets an unauthenticated attacker run code.

The vector chains two things: (1) writing attacker-controlled content into Laravel's log file through Ignition and (2) using one of the debugger's "solutions" to process that poisoned log with a deserialization gadget chain (phpggc gadget, usually Monolog/RCE). The result is command execution with the web server's privileges.

knqyf263's public exploit automates it: point it at the URL and run a command:

git clone https://github.com/knqyf263/CVE-2021-3129
# In exploit.py: Exploit("http://<ip>/", "id")
python3 exploit.py

It is identified by Laravel's error page, which in debug mode shows the framework version and the full trace, and by the /_ignition/execute-solution route responding (405 to GET).

Nuances. It requires APP_DEBUG=true; with debug mode off, Ignition does not expose the exploitable endpoint. The concrete chain depends on the phpggc version and the libraries present (Monolog, Faker...).

How to detect it. The access-log signature is an unauthenticated POST to /_ignition/execute-solution (and to /_ignition/health-check), endpoints that exist only with debug mode on and that no normal production operation invokes. On the host, the attack leaves writes to laravel.log with gadget content (base64/phar://) followed by the web process (php-fpm/apache) spawning sh/id as a child. The app responding with the Ignition error page (showing version and trace) already indicates APP_DEBUG=true, the attack's precondition.

Defence. APP_DEBUG=false in production, update Ignition to 2.5.2+ and do not expose the error page. Related to log poisoning and command injection.