Over one-third of APP_KEY disclosures coincide with additional secret exposures, including database credentials (MongoDB, MySQL, PostgreSQL), cloud storage tokens (AWS S3, Digital Ocean Spaces), and payment platform keys (Stripe, PayPal). A critical vulnerability in Laravel applications exposes APP_KEY configuration values, enabling attackers to achieve remote code execution (RCE). Legacy vulnerabilities like CVE-2018-15133 demonstrate how Laravel’s cookie serialization using SESSION_DRIVER=cookie enables trivial RCE attacks, while recent discoveries, including CVE-2024-55555 and CVE-2024-48987, show this attack vector persists in modern applications. Laravel's exposed APP_KEY enables remote code execution through automatic deserialization flaws. The vulnerability stems from Laravel’s automatic deserialization of decrypted data, combined with widespread exposure of cryptographic keys in public repositories. The critical vulnerability emerges from Laravel’s implementation, where the decrypt() function automatically deserializes decrypted data without proper validation. 35% of APP_KEY exposures include additional critical credentials like database and cloud tokens. The vulnerability affects applications across multiple Laravel versions, making it particularly widespread and dangerous. Research identified 28,000 such pairs exposed on GitHub, with approximately 10% remaining valid and 120 applications currently vulnerable to immediate compromise.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 11 Jul 2025 06:15:18 +0000