Vulnerability: Unauthenticated remote code execution in Ignition Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Vulnerability ID: GHSA-4qwp-7c67-jmcc
CWE: CWE-94
Severity score: 9.8
Project: https://github.com/facade/ignition
Published: 2021-03-29
File: src/Solutions/MakeViewVariableOptionalSolution.php
Commit message: Fix MakeViewVariableOptionalSolution to disallow stream wrappers and files that do not end in .blade.php

This is already fixed in 2.5.2, See https://github.com/facade/ignition/pull/334

I could not update to 2.5.2 due to some dependent package required php 7.3, currently clients site is running in php 7.2

On branch 2.4.1-branch
Changes to be committed:
	modified:   src/Solutions/MakeViewVariableOptionalSolution.php
Commit author: Anas Mirza

Vulnerable version (before fix):
  use Facade\IgnitionContracts\RunnableSolution; use Illuminate\Support\Facades\Blade;  class MakeViewVariableOptionalSolution implements RunnableSolution { public function run(array $parameters = [])         }     }      public function makeOptional(array $parameters = [])     {         $originalContents = file_get_contents($parameters['viewFile']);         $newContents = str_replace('$'.$parameters['variableName'], '$'.$parameters['variableName']." ?? ''", $originalContents); 

Fixed version (after fix):
  use Facade\IgnitionContracts\RunnableSolution; use Illuminate\Support\Facades\Blade; use Illuminate\Support\Str;  class MakeViewVariableOptionalSolution implements RunnableSolution { public function run(array $parameters = [])         }     }      protected function isSafePath(string $path): bool     {         if (!Str::startsWith($path, ['/', './'])) {             return false;         }          if (!Str::endsWith($path, '.blade.php')) {             return false;         }          return true;     }      public function makeOptional(array $parameters = [])     {         if (!$this->isSafePath($parameters['viewFile'])) {             return false;         }          $originalContents = file_get_contents($parameters['viewFile']);         $newContents = str_replace('$'.$parameters['variableName'], '$'.$parameters['variableName']." ?? ''", $originalContents); 

Patch:
patch: @@ -4,6 +4,7 @@
 
 use Facade\IgnitionContracts\RunnableSolution;
 use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Str;
 
 class MakeViewVariableOptionalSolution implements RunnableSolution
 {
@@ -70,8 +71,25 @@ public function run(array $parameters = [])
         }
     }
 
+    protected function isSafePath(string $path): bool
+    {
+        if (!Str::startsWith($path, ['/', './'])) {
+            return false;
+        }
+
+        if (!Str::endsWith($path, '.blade.php')) {
+            return false;
+        }
+
+        return true;
+    }
+
     public function makeOptional(array $parameters = [])
     {
+        if (!$this->isSafePath($parameters['viewFile'])) {
+            return false;
+        }
+
         $originalContents = file_get_contents($parameters['viewFile']);
         $newContents = str_replace('$'.$parameters['variableName'], '$'.$parameters['variableName']." ?? ''", $originalContents);
path: src/Solutions/MakeViewVariableOptionalSolution.php