Laravel - Information Disclosure (CVE-2017-16894)

Information Disclosure in Laravel, CVE-2017-16894 exposes a vulnerability in Laravel framework through version 5.5.21, where remote attackers can access sensitive information, including passwords, by directly requesting the /.env file. This flaw arises from improper file permission handling in the writeNewEnvironmentFileWith function, potentially leading to credential leakage and facilitating further attacks such as unauthorized access or privilege escalation.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of December 2023.

CrowdSec network data shows that most actors exploiting CVE-2017-16894 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2017-16894 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2017-16894 is currently experiencing high visibility and active exploitation across the internet.

Attackers attempt to access the .env file at the web root to obtain sensitive Laravel configuration data, including application secrets and credentials.