---
title: "Laravel Ignition RCE (CVE-2021-3129)"
canonical: https://trickest.com/library/cve-2021-3129-laravel-ignition-rce
description: "Flag Laravel apps for CVE-2021-3129 by reading laravel_version from a GET debug-surface probe. Floor 8.4.2. Needs debug markers. No file-write RCE."
---

# Laravel Ignition RCE (CVE-2021-3129)

## Overview

This workflow finds Laravel applications that still expose Ignition debug markers and sorts each host by whether `laravel_version` falls below the CVE-2021-3129 floor. CVE-2021-3129 is remote code execution through Ignition when a debug error page allows unsafe file write. This check never writes a file and never runs a payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/laravel-ignition-fingerprint-check-3129`, looks for debug-surface markers such as `laravel_version`, `ignition`, and `php_version`, parses the Laravel version, and compares it to floor 8.4.2. Hosts without that debug surface do not fingerprint as the product. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no Ignition file-write confirm.

Run it on a schedule when app deploys turn over. A staging box that left `APP_DEBUG=true` on an older Laravel 8 build is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/laravel-ignition-fingerprint-check-3129` on each host and fingerprint Laravel Ignition from debug markers such as `laravel_version`, `ignition`, `php_version`, and `data-page`.
3. Parse `laravel_version` and compare it to the CVE-2021-3129 floor 8.4.2 in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Laravel Ignition was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/laravel-ignition-fingerprint-check-3129` only. No Ignition file write and no RCE payload.

## Sample output

The records below are illustrative and do not come from a real run. They show one Laravel host below the CVE-2021-3129 floor, one at or above it, and one host without the debug surface.

```jsonl
{"url": "https://app.example.com", "is_product": true, "product_version": "8.4.0", "vulnerable": true, "detail": "below fixed release 8.4.2"}
{"url": "https://app.example.org", "is_product": true, "product_version": "8.4.2", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Laravel Ignition"}
```

```json
{"cve": "CVE-2021-3129", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Laravel versions does this flag?

Builds below floor 8.4.2 when the debug surface discloses `laravel_version`. The compare uses the version string that response itself served.

### Does an affected row mean Ignition RCE ran?

No. The check only GETs `/laravel-ignition-fingerprint-check-3129` and reads `laravel_version`. It does not write a file and it does not confirm RCE.

### Why do some Laravel hosts come back not detected?

The graph needs Ignition debug markers on the probe path. Production apps that hide the debug surface will not fingerprint as the product even when Laravel is present.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET. It does not log in or write through Ignition.

### What is CVE-2021-3129?

Remote code execution in Laravel Ignition when a debug error page allows unsafe file write. This workflow maps hosts to that CVE by debug-surface version exposure only.

## Related workflows

- [PHP CGI RCE (CVE-2024-4577)](/library/php-cgi-rce-check-cve-2024-4577). Reach for it when you need the PHP CGI argument-injection fingerprint on nearby app estates.
- [Metabase GeoJSON LFI (CVE-2021-41277)](/library/cve-2021-41277-metabase-geojson-lfi). Reach for it when the next app-layer flag is Metabase GeoJSON LFI, not Ignition.

---
_Markdown source of https://trickest.com/library/cve-2021-3129-laravel-ignition-rce._