CVE-2021-43617

Vulnerability

The Laravel Framework up to version 8.70.2 contains an incomplete file validation check in Illuminate/Validation/Concerns/ValidatesAttributes.php [1]. The validation logic does not include .phar files in its blocklist for executable PHP content. On Debian-based systems, .phar files are handled as application/x-httpd-php, allowing them to be executed as PHP if uploaded [1]. This bypasses the intended restriction that aims to prevent arbitrary PHP code execution through file uploads.

Exploitation

An attacker with the ability to upload files to a Laravel application (e.g., via a user profile picture or document upload feature) can craft a .phar file containing malicious PHP code. The attacker must not be filtered by any additional application-level checks. The upload is validated by the framework's built-in validation rules, which reject .php, .phtml, .php3, .php4, .php5, .php7, .pht, and .phps files, but not .phar. On a Debian-based server, the uploaded .phar file is interpreted as a PHP script when accessed via the web, leading to code execution [1].

Impact

Successful exploitation allows an attacker to achieve remote code execution (RCE) with the privileges of the web server user [1]. This can lead to full compromise of the application and server, including data theft, defacement, or use as a pivot point for further attacks. The confidentiality, integrity, and availability of the system are all at risk.

Mitigation

Laravel released a fix in version 8.70.3 [1]. Users should upgrade to this version or later. The patch adds .phar to the list of blocked file extensions in the validation logic. If upgrading is not immediately possible, developers should add custom validation rules to explicitly reject .phar files, or configure the web server to not execute .phar files as PHP. This CVE is not related to any third-party application code [1].