Is there a public PoC exploit available for CVE-2024-29291?

Yes, a public proof-of-concept exploit is available for CVE-2024-29291. Prioritise patching immediately. EPSS: 1.3%.

Laravel Framework CVE-2024-29291

Information Exposure (CWE-200)

2024-04-16 cve@mitre.org

Information Disclosure

Lifecycle Timeline

CVE Published

Apr 16, 2024 - 23:15 cve.org

N/A

DescriptionCVE.org

An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.

AnalysisAI

An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged. Version information: through 11.

Affected ProductsAI

Laravel Framework 8.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.