laravel-debugbar-exposure: Laravel Debugbar - Sensitive Information Exposure

2026-06-17 Laravel Debugbar PoC Public

Description

Laravel Debugbar (barryvdh/laravel-debugbar) was detected as enabled and publicly accessible. When left active in production, it exposes SQL queries, request data, session variables, mail logs, and application internals to any visitor.

PoC

id: laravel-debugbar-exposure

info:
  name: Laravel Debugbar - Sensitive Information Exposure
  author: moamenbasel
  severity: medium
  description: |
    Laravel Debugbar (barryvdh/laravel-debugbar) was detected as enabled and publicly accessible. When left active in production, it exposes SQL queries, request data, session variables, mail logs, and application internals to any visitor.
  remediation: |
    Disable Laravel Debugbar in production by setting DEBUGBAR_ENABLED=false in the .env file or removing the package from production dependencies.
  reference:
    - https://github.com/barryvdh/laravel-debugbar
    - https://laravel.com/docs/10.x/configuration#environment-configuration
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"_debugbar"
  tags: laravel,debugbar,misconfig,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/_debugbar/open"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "debugbar"

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ed4ea13ab37e52cf6132b85b1795ff3e4786e1e21bf2d41054ecc1607744aae1022100be60b4416a443733889d79bbb9f12ce217c886f85a70fa1f2a7b084731e1473d:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/laravel-debugbar-exposure.yaml

Related Vulnerabilities