{"id":"CVE-2018-15133","published":"2018-08-09T19:29:00Z","modified":"2026-06-17T01:42:06Z","title":"Laravel Deserialization of Untrusted Data Vulnerability","vendor":"Laravel","product":"Laravel Framework","tier":"core","eol":null,"description":{"text":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","provenance":"source","from":"NVD"},"summary":{"text":"Laravel Framework versions through 5.5.40 and 5.6.x through 5.6.29 contain a deserialization flaw, where an unserialize call on the X-XSRF-TOKEN value in the decrypt method of Illuminate/Encryption/Encrypter.php can be abused for remote code execution. An attacker would need network access and knowledge of the application key, which they would typically only obtain through prior privileged access or a previous successful attack, and no authentication or user interaction is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:40Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.7657,"percentile":0.9954,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2024-01-16","dueDate":"2024-02-06","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30; https://nvd.nist.gov/vuln/detail/CVE-2018-15133","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-03-17","exploitedFirstSeen":"2023-03-17","ransomware":false,"evidence":[{"url":"https://www.fortiguard.com/threat-signal-report/5066","date":"2023-03-17"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a","date":"2024-01-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-16"},{"url":"https://www.fortiguard.com/outbreak-alert/androxgh0st-malware","date":"2024-01-17"},{"url":"https://blogs.juniper.net/en-us/security/shielding-networks-against-androxgh0st","date":"2024-03-19"},{"url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf","date":"2024-05-06"},{"url":"https://isc.sans.edu/diary/Who%20You%20Gonna%20Call%3F%20AndroxGh0st%20Busters!%20%5BGuest%20Diary%5D/31086","date":"2024-07-16"},{"url":"https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave","date":"2024-11-07"},{"url":"https://www.synacktiv.com/en/publications/laravel-appkey-leakage-analysis","date":"2025-07-10"},{"url":"https://falconfeeds.io/blogs/proxy-networks-and-the-rise-of-disposable-iaas","date":"2026-01-29"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote attack via public-facing web application input","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value","start":62,"end":176}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unserialize yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"remote code execution might occur as a result of an unserialize call","start":62,"end":130}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Packagist","package":"laravel/framework","vulnerableRanges":["<=5.5.40",">=5.6.0, <5.6.30"],"patched":["5.6.30"],"from":["GHSA-qvqm-h22r-4cp9"],"provenance":"source"}],"advisories":[{"id":"GHSA-qvqm-h22r-4cp9","url":"https://github.com/advisories/GHSA-qvqm-h22r-4cp9","severity":"HIGH","ecosystem":"Packagist","package":"laravel/framework","vulnerableRanges":["<=5.5.40"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-qvqm-h22r-4cp9","url":"https://github.com/advisories/GHSA-qvqm-h22r-4cp9","severity":"HIGH","ecosystem":"Packagist","package":"laravel/framework","vulnerableRanges":[">=5.6.0, <5.6.30"],"patched":["5.6.30"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5039","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5039","exploited":true,"exploitedSince":"2024-01-16","provenance":"source"},"exploits":[{"id":47129,"url":"https://www.exploit-db.com/exploits/47129","title":"PHP Laravel Framework 5.5.40 / 5.6.x < 5.6.30 - token Unserialize Remote Command Execution (Metasploit)","type":"remote","platform":"linux","date":"2019-07-16","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-07-16"},"pocGithub":{"count":12,"skipped":2,"earliest":"2018-08-14","earliestUrl":"https://github.com/kozmic/laravel-poc-CVE-2018-15133","repos":[{"name":"kozmic/laravel-poc-CVE-2018-15133","url":"https://github.com/kozmic/laravel-poc-CVE-2018-15133","stars":258,"created":"2018-08-14"},{"name":"aljavier/exploit_laravel_cve-2018-15133","url":"https://github.com/aljavier/exploit_laravel_cve-2018-15133","stars":57,"created":"2020-11-13"},{"name":"pwnedshell/Larascript","url":"https://github.com/pwnedshell/Larascript","stars":35,"created":"2020-12-21"},{"name":"Prabesh01/Laravel-PHP-Unit-RCE-Auto-shell-uploader","url":"https://github.com/Prabesh01/Laravel-PHP-Unit-RCE-Auto-shell-uploader","stars":6,"created":"2020-04-05"},{"name":"AzhariKun/CVE-2018-15133","url":"https://github.com/AzhariKun/CVE-2018-15133","stars":3,"created":"2021-01-03"}]},"metasploit":[{"name":"PHP Laravel Framework token Unserialize Remote Command Execution","module":"exploit/unix/http/laravel_token_unserialize_exec","type":"exploit","disclosureDate":"2018-08-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb"}],"first":{"date":"2018-08-07","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html","https://github.com/kozmic/laravel-poc-CVE-2018-15133"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2018-08-07","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2018-08-14, Exploit-DB 2019-07-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/laravel_token_unserialize_exec.rb","provenance":"source"},{"date":"2018-08-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15133","provenance":"source"},{"date":"2023-03-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortiguard.com/threat-signal-report/5066","provenance":"source"},{"date":"2024-01-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-01-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5039","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1986},"priority":{"score":68.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1322 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9954"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 12 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}