Laravel · Laravel Framework
Laravel Framework versions through 5.5.40 and 5.6.x through 5.6.29 contain a deserialization flaw, where an unserialize call on the X-XSRF-TOKEN value in the decrypt method of Illuminate/Encryption/Encrypter.php can be abused for remote code execution. An attacker would need network access and knowledge of the application key, which they would typically only obtain through prior privileged access or a previous successful attack, and no authentication or user interaction is required.
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
First seen exploited 5 years after disclosure. Public exploit code (Metasploit) was available 2 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Remote attack via public-facing web application input
remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value
Unserialize yields arbitrary code execution
remote code execution might occur as a result of an unserialize call
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: laravel/framework.
Upgrade to 5.6.30
Still affected on this line by CVE-2024-52301 (fixed in 6.20.45, a newer line); CVE-2026-114509 (fixed in 12.68.0, a newer line).
Set the version to 5.6.30 or later in your composer.json.
The first fix for CVE-2018-15133.
| If you run | Upgrade to |
|---|---|
| 5.6.0 up to 5.6.30 | 5.6.30 |
| 5.5.40 and earlier | No fix published |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.