Laravel <= v8.4.2 debug mode: Remote code execution

[xzd]

https://www.ambionics.io/blog/laravel-debug-rce

[driesvints]

Don't enable debug mode in production. Also: please don't post issues about security vulnerabilities (see our readme).

https://laravel.com/docs/8.x/configuration#debug-mode

[lucaspanik]

@driesvints

I am having the same problem in my homologation and staging environment.

Argument 1 passed to Facade\Ignition\Solutions\MakeViewVariableOptionalSolution::isSafePath() must be of 
the type string, null given, called in 
/var/www/vendor/facade/ignition/src/Solutions/MakeViewVariableOptionalSolution.php on line 88

Request:

{
    "method": "POST",
    "URL": "http://remote_ip/_ignition/execute-solution",
    "remote_ip": "remote_ip",
    "request": {
        "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
        "parameters": {
            "variableName": "username",
            "viewFile": null
        }
    }
}

After upgrading from Laravel 7 to Laravel 8.27.0, these errors started to appear in my staging environment, but they don't appear in my production environment.

After analyzing the differences between environments, I thought it could be something related to APP_DEBUG=true in my staging environment, and APP_DEBUG=false in my production environment.

And I found this links:

• PSA: Laravel <= 8.4.2 has vulnerability (CVE-2021-3129)
• Laravel <= v8.4.2 debug mode: Remote code execution (CVE-2021-3129)

When executing the command ps aux | grep kdev on my staging server, I did not identify the process kdevtmpfsi running, only kdevtmpfs (without the letter i at the end) that is default by system, as you can see in the image below.

The problem as described in the first link is referencing the "facade/ignition" package that deals with the new Laravel error page and that the problem can be seen at facade/ignition#334.

In summary, I think the case is happening for applications that have been upgraded from Laravel less than 8 to 8.x, because they suffered this "invasion" before the update.

Even knowing that debugging should not be enabled in the production environment, how to work with debugging in the staging environment? What do you recommend to me?

My question is what to actually do to deal with this vulnerability since I am already in version 8.27.0 of Laravel.
Remove the "facade/ignition" package?
Do I update the "facade/ignition" package (I am currently in the "facade/ignition": "^2.3.6") ?

Thank you for your attention, I hope I have helped, I am waiting for help to make the right decision.

[tudorradubarbu]

Absolutely nobody from Laravel offers support on this one. It's just blank.