What this checks: whether a Laravel (Ignition debug error page) host runs a version affected by unauth RCE via Ignition file-write, debug-mode only. Read-only: it fingerprints Laravel (Ignition debug error page) and reads the version, no exploitation.
3. Detection — reads the Laravel (Ignition debug error page) version from the version exposed at /laravel-ignition-fingerprint-check-3129, compares to 8.4.2. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Laravel (Ignition debug error page) URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Laravel applications that still expose Ignition debug markers and sorts each host by whether laravel_version falls below the CVE-2021-3129 floor. CVE-2021-3129 is remote code execution through Ignition when a debug error page allows unsafe file write. This check never writes a file and never runs a payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /laravel-ignition-fingerprint-check-3129, looks for debug-surface markers such as laravel_version, ignition, and php_version, parses the Laravel version, and compares it to floor 8.4.2. Hosts without that debug surface do not fingerprint as the product. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no Ignition file-write confirm.
Run it on a schedule when app deploys turn over. A staging box that left APP_DEBUG=true on an older Laravel 8 build is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /laravel-ignition-fingerprint-check-3129 on each host and fingerprint Laravel Ignition from debug markers such as laravel_version, ignition, php_version, and data-page.
Parse laravel_version and compare it to the CVE-2021-3129 floor 8.4.2 in the graph.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Laravel Ignition was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /laravel-ignition-fingerprint-check-3129 only. No Ignition file write and no RCE payload.
Sample output
The records below are illustrative and do not come from a real run. They show one Laravel host below the CVE-2021-3129 floor, one at or above it, and one host without the debug surface.
Builds below floor 8.4.2 when the debug surface discloses laravel_version. The compare uses the version string that response itself served.
Does an affected row mean Ignition RCE ran?
No. The check only GETs /laravel-ignition-fingerprint-check-3129 and reads laravel_version. It does not write a file and it does not confirm RCE.
Why do some Laravel hosts come back not detected?
The graph needs Ignition debug markers on the probe path. Production apps that hide the debug surface will not fingerprint as the product even when Laravel is present.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET. It does not log in or write through Ignition.
What is CVE-2021-3129?
Remote code execution in Laravel Ignition when a debug error page allows unsafe file write. This workflow maps hosts to that CVE by debug-surface version exposure only.
Related workflows
PHP CGI RCE (CVE-2024-4577). Reach for it when you need the PHP CGI argument-injection fingerprint on nearby app estates.