HUNT-LARAVEL, Laravel Specific Vulnerabilities

Crown Jewel Targets

Laravel debug mode enabled in production = instant RCE via Ignition (CVE-2021-3129).

Highest-value findings:

• Ignition RCE (CVE-2021-3129), APP_DEBUG=true + Laravel < 8.4.2 → /_ignition/execute-solution RCE without auth
• Telescope dashboard, /telescope exposes full request/response logs, DB queries, Redis commands, scheduled jobs, environment variables
• Horizon dashboard, /horizon exposes queue job details, failed jobs with full payloads (may contain API keys, PII)
• Signed URL manipulation, if URL::signedRoute validates wrong params → bypass signed URL → unauthorized actions
• .env exposure, APP_KEY leaked → decrypt all encrypted cookies → forge session → ATO

---

Phase 1, Fingerprint Laravel

# Laravel-specific indicators
curl -sI https://$TARGET/ | grep -i "laravel_session\|x-powered-by.*php"
curl -s https://$TARGET/ | grep -i "laravel\|Illuminate\|csrf-token"

# Common Laravel paths
for path in /storage /public /resources "/vendor/laravel" "/.env" "/artisan"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$STATUS" != "404" ] && echo "$path: $STATUS"
done

# Check error page (trigger 404)
curl -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony"

---

Phase 2, Debug Mode & Ignition RCE (CVE-2021-3129)

# Step 1: Check if debug mode is enabled (Whoops error page)
curl -s "https://$TARGET/nonexistent" | grep -i "Whoops\|APP_DEBUG\|Ignition"

# If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129

# Step 2: Check Ignition endpoint
curl -s "https://$TARGET/_ignition/health-check" | head -5