Laravel

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

About

Laravel is the most common framework for building PHP web applications. It gives developers routing, templating and database access out of the box. It runs on the PHP runtime, inside Apache or with nginx in front of PHP-FPM.

How to Spot It

These are signs that a system runs Laravel, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Cookie

laravel_session

Cookie

XSRF-TOKEN

If It Has a Flaw

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Laravel sits.

• CVE-2021-3129 (opens in a new tab)2021

  Ignition Debug Page Code Execution

  A debug tool left enabled let attackers run code on the server.

  Reach It reached the whole application and the account it ran as.

Rivals

Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Laravel.

• ASP.NET
• Express
• Spring
• Django
• Ruby on Rails

Stacks and Code

Its code arrives from the sources listed, and each source's page says how bad code could get in through it.

Its Code Comes From

PackagistCI and Build Systems

Sources

• Laravel documentation (opens in a new tab)