Laravel Ignition File Upload Vulnerability (CVE-2021-3129)

What is affected, what to do

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Laravel Ignition to version 2.5.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Laravel Ignition lt *..2.5.2

Fixed in

• Laravel Ignition 2.5.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade facade/ignition to 2.5.2 or later: composer update facade/ignition --with-dependencies. All versions below 2.5.2 are vulnerable when combined with Laravel < 8.4.2.
   • Disable Laravel debug mode in every production and staging environment: set APP_DEBUG=false in .env, rebuild config cache (php artisan config:cache), reload PHP-FPM/web server. Without debug mode the exploit path is unreachable.
   • Inventory public-facing Laravel instances: grep -r "APP_DEBUG=true" across deployment repos, plus HTTP scan for Ignition error pages (responses referencing /_ignition/execute-solution).
   • Push a reverse-proxy/WAF rule that blocks external access to /_ignition/* until patch and config change are verified.
   • Forensic triage on exposed hosts: inspect storage/logs/laravel.log, web access logs and /tmp for POST requests to /_ignition/execute-solution and newly dropped PHP files since September 2023. On any hit, treat the host as compromised: rotate APP_KEY, session secrets and database credentials.
   • Restrict outbound traffic from the web-tier segment to an explicit allowlist (known APIs, DB, package mirror) to break second-stage payload retrieval and reverse shells.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Laravel workers and PHP-FPM nodes should not egress directly to the internet. Force egress through a proxy allowlist; block common C2 ports (4444, 1337, 8080 outbound).
   • WAF/reverse proxy: block POST to /_ignition/execute-solution and inspect bodies for MakeViewVariableOptionalSolution or variableName. For nginx: location ~ ^/_ignition/ { return 403; }.
   • Configuration hardening: remove facade/ignition from production entirely (composer remove --dev facade/ignition); it is a dev-only package. Verify your build pipeline uses composer install --no-dev and that stale autoload entries are not shipped to prod.
   • Filesystem hardening: mount storage/ and bootstrap/cache/ noexec; constrain open_basedir to the application root in php.ini; set disable_functions = exec,passthru,shell_exec,system,proc_open,popen in PHP-FPM pools that do not require shell execution.
   • Log integrity: ship laravel.log to a WORM store or remote syslog before an attacker can poison it. The exploit abuses the log file as a Phar deserialisation payload carrier, so tamper-evident logging is both a control and a forensic artefact.
   • CI/CD gate: fail the pipeline on any deployment that carries APP_DEBUG=true or exposes facade/ignition in the production autoloader.
3. 03

   Runbook step 3

   Detection rules

   • Web access log: POST requests to /_ignition/execute-solution or /_ignition/health-check. Splunk: index=web uri_path="/_ignition/execute-solution" method=POST | stats count by src_ip, host. Any hit from the internet is suspect.
   • Sigma shape (web server): detection: selection: cs-uri-stem|startswith: '/_ignition/' cs-method: 'POST' condition: selection.
   • Payload markers in request body or logs: strings MakeViewVariableOptionalSolution, viewFile, phar://, file_get_contents, or base64-encoded PHP (PD9waHA).
   • Sysmon/auditd on the web host: php-fpm or php as parent of sh, bash, python, curl, wget, nc. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("php-fpm","php") and FileName in~ ("sh","bash","curl","wget","nc","python","python3").
   • Filesystem: new or modified .php files under storage/logs/, storage/framework/, or public/ outside deployment windows. Auditd: -w /var/www/*/storage -p wa -k laravel_write.
   • Network: egress from the web-tier segment to pastebin, raw-GitHub, or IP-literal URLs within 60 seconds of an /_ignition/ request — correlate in SIEM.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Source: NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Laravel Laravel Ignition

References & sources

• NVD (NIST)vuln/detail/CVE-2021-3129advisory
• github.comfacade/ignition/pull/334web, x_refsource_MISC, Patch, Third-party advisory
• github.comfacade/ignition/commit/11ffca14abd22db779d90b12e193f8000f6d184bweb
• github.comFriendsOfPHP/security-advisories/blob/master/facade/ignition/CV…web
• github.comfacade/ignitionpackage
• ambionics.ioblog/laravel-debug-rceweb, x_refsource_MISC, Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129web, government-resource, US government resource
• packetstormsecurity.comfiles/162094/Ignition-2.5.1-Remote-Code-Execution.htmlweb, x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/165999/Ignition-Remote-Code-Execution.htmlweb, x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database