CVE-2018-15133: Laravel Deserialization of Untrusted Data Vulnerability

Vulnerability summary

CVE-2018-15133 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in Laravel Laravel Framework. It is known to be exploited: CISA lists it, first on 16-01-2024. EPSS estimates a 76.57% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 09-08-2018
   PublishedVulnerability first disclosed.
2. 16-01-2024
   Added to CISA KEVLaravel Deserialization of Untrusted Data Vulnerability
3. 06-02-2024
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.