laravel-debug-enabled: Laravel Debug Enabled

2025-08-01 Laravel PoC Public

Description

Laravel with APP_DEBUG set to true is prone to show verbose errors.

PoC

id: laravel-debug-enabled

info:
  name: Laravel Debug Enabled
  author: notsoevilweasel
  severity: medium
  description: |
    Laravel with APP_DEBUG set to true is prone to show verbose errors.
  remediation: |
    Disable Laravel's debug mode by setting APP_DEBUG to false.
  metadata:
    max-request: 1
  tags: debug,laravel,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_ignition/health-check"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - can_execute_commands

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f7ad81d93311f60c637be3322a011f6787545c6873ff79b167a74b77aa711fa6022100cb2855da07b55a357f77facccdd7d7dcc143728080dbd3019e9079b0c67c90b5:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/laravel-debug-enabled.yaml

References

Related Vulnerabilities