Laravel Deserialization of Untrusted Data Vulnerability (CVE-2018-15133)

What is affected, what to do

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Laravel Framework lte *..5.5.40
• Laravel Framework lte 5.6.0..5.6.29

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every Laravel deployment (composer show laravel/framework or parse composer.lock). Affected versions are up to and including 5.5.40, 5.6.0 through 5.6.29, and the 4.x line.
   • Patch: Upgrade to 5.6.30 or later. For 5.5, use a release after 5.5.40; check the vendor advisory for the exact version. The 4.x and 5.x branches are end-of-life, so schedule migration to a currently supported Laravel branch.
   • Rotate APP_KEY now (php artisan key:generate), regardless of patch status. Exploitation requires the key, and a leaked key keeps cookies and sessions forgeable even after the upgrade. Rotation invalidates all sessions, so give users a heads-up. Any data encrypted via encrypt() must first be decrypted with the old key and re-encrypted.
   • Check for key exposure: Is /.env, /.git/config or /storage/logs/laravel.log publicly reachable? Is APP_DEBUG=true set in production? Was .env committed to a repository, or is the app running a default or sample key? Treat any hit as an indicator of compromise.
   • If exploitation is suspected: Isolate the host and preserve evidence (webroot, logs, crontabs, /tmp). Rotate every secret held in .env: database, mail, cloud API keys and AWS credentials.
2. 02

   Runbook step 2

   Mitigation layers

   • Web server config: Hard-deny dotfiles. For nginx: location ~ /\.(env|git) { deny all; return 404; }. For Apache: <FilesMatch "^\.">Require all denied</FilesMatch>. The DocumentRoot must point at public/ only.
   • WAF/IPS: Alert on or block oversized X-XSRF-TOKEN headers (over roughly 1–2 KB). Do the same for Base64 values that don't match Laravel's normal {"iv":…,"value":…,"mac":…} JSON structure. Rate-limit, then block, scanners probing /.env and /.git/.
   • PHP hardening: Set disable_functions = system,exec,shell_exec,passthru,proc_open,popen,pcntl_exec in php.ini where the application allows it. Restrict open_basedir to the project directory.
   • Segmentation and egress: Apply default-deny outbound rules on the web tier and allow only required destinations. This kills curl/wget payload staging and reverse shells.
   • Secrets management and least privilege: Load APP_KEY and other secrets from a secrets store (e.g. Vault or cloud KMS) rather than a plaintext .env in the webroot. Run PHP-FPM without write access to code directories.
   • File integrity: Set up FIM on public/, app/ and vendor/ to catch dropped webshells.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (EDR/Sysmon for Linux EID 1, auditd execve): Alert when php-fpm, php or apache2/httpd spawns a shell or download tool. Sigma shape: ParentImage|endswith: ['/php-fpm','/php','/apache2','/httpd'] AND Image|endswith: ['/sh','/bash','/curl','/wget','/nc','/python3'].
   • auditd: -a always,exit -F arch=b64 -S execve -F uid=33 -k web_exec (adjust to the uid of www-data). Any execution outside the expected binaries is an alert.
   • Web access logs: Requests for /.env, /.env.bak, /.git/config or /_ignition/ returning 200. SPL: index=web uri_path IN ("/.env*","/.git/*") status=200 | stats count by src_ip, host. A 200 on any of these means a likely key leak.
   • Application log: Bursts of DecryptException or "The MAC is invalid" in storage/logs/laravel.log point to attempts with a wrong key. If suspicious requests stop producing these errors, the attacker likely holds a valid key.
   • Network (Zeek/Suricata): Web servers connecting to unfamiliar external IPs shortly after POST requests carrying a large X-XSRF-TOKEN. Also watch for new long-lived outbound sessions from the web tier.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Source: pwn.watch, NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Laravel Laravel

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• NVD (NIST)NVD: CVE-2018-15133advisory, pwn-watch
• github.comlaravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083…web
• github.comkozmic/laravel-poc-CVE-2018-15133web
• github.comlaravel/frameworkpackage
• laravel.comLaravel advisory: CVE-2018-15133web, x_refsource_CONFIRM, Vendor advisory, pwn-watch
• packetstormsecurity.comfiles/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Com…web, x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133government-resource, US government resource
• pwn.watchpwn.watch: Laravel Deserialization of Untrusted Datapwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch