Over 600 Laravel Apps Exposed to Remote Code Execution Due to Leaked APP_KEYs on GitHub
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-15133 | Deserialization RCE in Laravel Framework via X-XSRF-TOKEN Header | 8.1 | 77% | KEVPoC | KEV |
| CVE-2024-55556 | Unauthenticated RCE in Crater Invoice via Laravel APP_KEY and tampered session cookie | 9.8 | 44% |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have discovered a serious security issue that allows leaked Laravel APP_KEYs to be weaponized to gain remote code execution capabilities on hundreds of applications. "Laravel's APP_KEY, essential for encrypting sensitive data, is often leaked publicly (e. g.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.