Exposed APP_KEYs threaten widespread Laravel app compromise

More than 600 apps in the open-source PHP web framework Laravel could be subjected to remote code execution attacks using APP_KEYs for data encryption that have been exposed on GitHub, according to The Hacker News.

Obtaining access to the APP_KEY, an encryption key generated during the Laravel installation process, would enable subsequent abuse of a deserialization vulnerability for arbitrary code execution on the Laravel web server, a report from GitGuardian revealed. Additional findings revealed the leakage of almost 28,000 APP_KEY and APP_URL pairs, nearly 10% of which are valid, indicating RCE attack risks to 120 apps. Such findings should prompt the improved management of exposed APP_KEYs. "The proper response involves: immediately rotating the compromised APP_KEY, updating all production systems with the new key, and implementing continuous secret monitoring to prevent future exposures," said GitGuardian. Separate reports from GitGuardian and Binarly also showed the elevated prevalence of exposed secrets in Docker images.