安全研究
CVE-2024-29291 Laravel 数据库凭据泄露：PDOException 日志写错
Thinking
2024-03-22
3 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Laravel 在 PDO 异常时把数据库连接信息（含密码）完整 dump 到日志，攻击者拿到日志文件就能用里面的 DSN / user / pass 直连数据库。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237687c68823690cc05eab1af0a9181f65d02f41c4ce281003503137b483e0d00cea8861b4165b0fbf5f93c291d8508f5ce98459b52891801745960aa1aa8a67b44fa5c9eb372bc0cbff230184d78c6226446c5f46ae35b5229ffb68f26fb6e98925ca0a23a434a910463c6f1e797e825afef61e29612353b3235acaf2d82a35e7f160e1fb19ce522435a47c826095fdc8c120361b315eb6895657802bb5ab9c4cd9b4064c0bf060277e8de26f43546282dd55a1c8d9ef71f58a8897fb770372ffaabd48d76463fd2a8ade7c29da7b5426f764d70291f2b67d7e96448e9b320a43c3bf7408a20572cc4eb162dc1322eff24d38d974a267eeb8a5dab9f5fdf199e29ceb0843575459111e8a9f606a1fe04f37c6e8da629464b8f23e2460b2893935b76bc4d748082fd12cc988410d19d3a8cead2d1dfb113c0ceee04b3dcf22e2cf865b5134d3d9fb0977585ff4e6a4b49af854525885ea05fc006879a9a5d49af3b4643e7602b5c927ef156c95b61806c4652695193320dbad1802f9c0eb6651084cf5989b9abc9db6088e2098426957d204e0ef242438bce3c6ffdb890a2c39822756d4d0b674951cc6a7099951daaad3439c8c04647f4dca9aecdad44959688253b86a4265af5a73fd1f864c88100da40a8e697a1be9b5e2ae78edfabf334378f7394b88581a2fa446181963959852b564732a6110193a2d6715abd694628ebf6a3dac6d2fea71dcabf2f65010568d852be45090c3abff58bbd6aad75fa09b5d341e4f8860371713d3f6ebf0a89671bccc2dec3001ba73eaad05aeaabba6c70a81cc89c5cef386b5b9596dafb39ba76c316416558ca1721317b94b288556b69d52e722f9ec654ada5b9d799ada88837c8907826a1cdd1acc1f83a624f8fbfdf631375e4778b65bb2de882288829c45e4941f7c1023dc544334306864341006725719d77b496f12596751b5dff2955e2b5e1dd7727a93de9746d5c9336781c89c01dfb8e42240e01758ec64607dfc3f52911cef85f3a7fca0134780fb86392cf0f9446590d3991f3b21c1411e66d1fea8e36c363ce76ec06a93ef6251b04e59f82b70af095943d5ae0465bdde9a1f287ce8d07b353062e7e619c4d572ec194a7a3407d74dcefc0f4fdcf2c5c40206ddfe0a2e3e7b08b198967336dde1df0f3a4d5ce8df555e3a5a3e3b657c010919bfd9db03dc4a199ffbdb8ea123be05d3267bdc5e3b885ec1f59aaa6acaa5f5072739db7c068c979a43d49da206dd7be562106e606d7296e00459dc33ab2523250d19da7520fdd9ec04c243a3960cb672ae355b6a3764a8a2d367f25d67723b086a48cddefc3f4a37a5372db3015d9e6ca4ae6d81f6eeac6858182bf48a21f284cdf982ffd60920a9f67fc647080dcd03a5bf1c3317543067de89da252dca1218e9fc374faceaaf11a47dec3e72a4e70c3690272b3f886b1730a141709f9a247f966127633758a4d1314e926c86457ab9837113edaf44a832e383b2ae28d0dee1371b1c3676cbdc79b6ba802cc3b5a580b530d9704c193bdc3e393ce3f6ee7d8dddef6dc3bd3ab1bf44b479fdf61ec24a84512fc6d9b65197abab491994cc7bbbe2acbe9303e6d8997c6dc2496cdbdacc99034ba64904e1f92d5653cd56bf6e05d14c9530e849e2c5c50e659dff938c42074b931a098b27d1479a62dbf1353bb309684f0399e2dfc4b06a91c289684fa700f35149e9c6e9e5202c76190f2f92003c7efce0690dfb1712fe9be838b9661592eb239455a8ff0ac3babf60d43356d68531731cb32ebab0d1c98bdf9c102edfdded4a94a0ffa3e91b1f20bff4e4fbd752ab49f7ec7a9b6b4c4593a2e1ade94d074ea74400ddb247541c14c1f8299941152f4c6050808f34cc1a2da1c4767e108c57415870ec0422219f03ab7edf402f29da7930fcd1d7e74796c2091108e4b690b2a98773912698291983911f7f840d76a5638aa1cf15330c2baa196e0c0c673a95b4da7343556f1f635b699fde1d507511d18cd33d9d717844358f0331e34a9bcd2af0a9a6de42df808b0bddeaa4bf0e5e1096514fd1ea736c1a4e585bec7b0f6ed05a9a02b2a24cb325540dc88207cf2376a2c380c2ba49fef4cd60e00798b92981c2e508d58a75fb5946d5926901c2f8016bdacbde99b6228d58b3f1d1bdd26dcf256b16489632810e5351ea6c05db89465c6d32e673f72fd9cf282bdae56d730769bcc5d1b007815a5292a73b273e7787a86520beec33f6bcbf71a4a8abbeda53adfb8544895f15e1023033b66feb7d719397f599cb83b96c3aceb1fb608b1c5df639afb5caf1221c34b254a5d695cc0dfcfea00e9475cfddadb32687e85215f4cbdde5c112090d696fad12589a5dc8550d1bb35bed4dfddce68c77eed961345085c3d1347e95b5ecf4b710bf6dbd99caca304a0f1cf75c802c2181000d75df088deed1b30c33042cbbdc5e2fda6c7edb3e5661c9b49cf8d03552d208ce0ee574d5d59010ae5cda331e6050bd4ea78aa3669af60e798782c32b5ab1a171868c9e95411853e31a9c49678d315c06352366fed2ee9b76e8ac6a32dde82092871605794f8205af85fcf9b3031ae09bdca0bca254d46361006c133bfcd120e812db29a04553b237d5a12ec2d9cfdae14823a9c00f6588ea0d2c4515b52d636836f5bd557c7bbff9d6342dc08207dc197ec377ad3a9910a679310916b24c32e3368d787ed497a191985ef2bdc256f1e853017e70b74847f51353c46145eef69b24623b55590be7e01b959fdb48c3a703f5f3aee22538acf6da4b98923428a09604f35498aa7bfa5274df8b521bf339c2b054975f2267bf3a41eadf02c29e64170ee520a047f934f378adf22d84cc0a01d4431b62c8e6f25fdafb4f8081771ba36571e84a42f0f3ed0e6b28fd8afb62d01c37f58c571df59ae8d1d3db492943799f8df1cc12a1fb4bdf03aa58c089418df48c2a7bfda33b5af4dfc684bbc4a68d9bcf0a7a4aa13319c080ab55bb0dd9739738918b78feb982d02229743074c2774539e188e14fbc2365a820aecacf9903fa7e8f724698ba6916d0442dc33b16fc603f315cd1245c792b34e3db972a2883dcea271e05c15f9bb4e8b62905b27bc3ee8be9da40139f934c35236f5781bdcb0c670954c3c4259ba2faeb1b3b3f39d3f7b3fa4f1632168f0c29e3fabd774680b919b215bf6b54685ffa28bd212c480ac4f7a4fe78adb798a975abd32909e862ab3fe870b5e6bc6ebd31c390ec1046c7af730e6100c9cc4125eb2bab3eebd05e78f05dcfcad731f1bac9a0083f5c6f6e8010b59c77598ffa7521373227196b33eff335786664aae2ff572d0efd60f9ffb431d87d2eff36a1c3e3cdee1601f9b2ef76af01e9a7f95de7c9d232418bd46050b98d18364b959bbd3082efac49b20a95b730d609b279a76ea7dc34b4bd2f5f0527697230c726c58e54d16a986474018cc8d7a149dfa73fd762b0fb796059e07b682671b9f6151482012d3475d9ee83a39dd3d602fff384aee9c53ba216ff9896616ed759e3d419f6d3cd8eb617ffe97a4e79c7dc0352523b5e1261c5d55fcb48b26ebae0e1183608feac6b64fbaadb936867358dd68ea02c4b7d5bf849526a5245c85a1cf8289e949863e5a1b6600a88bcc5f30ed388efe8a2840ed0c893ee9aa8d6739557e7b0d79adee8da8dabb8e84dc8979395be6cdb35c8f3e72596fd1672b56d44b4be6908fa5bb77d9fafdbc78edc3c577ee4d27381f4daca380ebd834a40cca8192d66fe67c302013e71eb46ef12d19327a07889fda2c4b9ab889331ed54f85bebf0f8b5a23c7fd9097a46e0b776a424c0b36c19428c24188d5023efa0a02160f6acc946cfb6c81b6ad49cb538089b045136de0a2076df0cb04b5bf7c14fbe7882266941a37c9ecfe2ec074fe9e9e7537f7bdf4e5a13670d5374596850b3f0bc14cd0f1a682546ea3089e5b8d9b120a0e0f0102361a498065a0e458a1f681d08497a85dcb2f0757044d95123fa1721f3569348ce251fdf121c0dab8fabec580f1dc8e39d6d7854b88b27ddf48a728901425719f4cfced9e4cc5d021ae2121318bb9f2de1b2de7fd3d4bd5ef6346bd585090b627de2db9fe8324e5d3bd500e495ab3b6f76f2a394db0b43ab310d45ad1b4bc377dc9b1c9b72fcecd7169af66ab420e9d2802d963431a1490ad0d466176c12693279077147a8c6b21fe8e3d08a9af75bc6948f4cca8b871c427fcdbb860b50909677e96ab36293815555079e623cea01144c5c04322bd51ceefd7f30d528f265003807df54b1e8787f302394de4cff1cfb1aeb4f0a25a96ce634dec08c831e55b6c7c85621c8f1ada7752ef87b79e087e7d5cbde7d83e43c48f54a56c6cf404fdc05b26c288c67d8b8abff357907939e4dc78c06d35f3e5a618699f1d9c4e36cbaf123a87ae7d367c24ab835a3b08099e07ce483dc98ea0c3f19ca1641734463fc7bc5b060677d7c680e2d966fbc14d343a3b57e742425e1adff4f18d27566a9ccc0f5db0cbc55f3efc20a1582ae8c7afac7386f60779199f7fe2ab89b31ac78706f86fc7c354470c9307367db990be05e5ddf70c47ac37810f85d7458e2393b99e8dabb58b4f7f587e696de4f90fa1cd5e0cf4860f78e4b75b33d89b5e251e9b83fe7df273b4725a149361c52cd806ff0cadfd8d69c0c4b12f5733f4f0175724c64e5e115159849bee6b23006c13342db1ce619a01350eb1e3d072b751d3d657464f8f992303be33139c4030626553c9cfbd82d020faf3ac5adf8651c93676fc342f35293be3a5bb494f61864a3c927b997a37c9c6038c3afecd33f55b68f882284d74f78cb84d2985e496c0784f3fbf7b04934ed9c9d4803280111a340e0f44c5a3b1344117531a24dc15ec3d69cc570d802ddd928995ec931a3fd37d46c7c6f430c8f8a691f952ce28e2c36eb73f1ca7b212c914195d0e259c824072db60d23ce83370960ea378f11c1b14111f68ac8ac0ee14484be92f0592df6ef1a5e302cbced15ef4230c461932f4eb4468462d62636168fcf7599867752c253957446616d7acfd56b4aa25016889e2cba4c1d4ec3d6055fa5e6fe085aed540d80e1cf8a8cc1bff9fd9eec283c651112d4721cef4a8c45456677ced788940104e277013f61c4890793ee9c696af7975d5775bc9ac4fab2b9b99f32a2c7fd112539f278f7c7aeeb0f3106964d14e33b86982dc9698833ce88a20abf3eeb005d141722ba365b581e36bda4644d80440d2eda83b3c1ec500317d2050ed16a9ce767207f66520852dc6caf82091b8fa0bb94dee5e38fcf3c3fe8f0620711022cc4d2c0d917946d04377242f3cf2cb8476876f830b89ec83f2490e2673d1eea8dab1045ba887020dfc2c93f61f2ab9b12bbdf7a6071595310c39882883b7d017676b7bd1e8e9dc74ada58cbe5e1bc2d0742aa5d68302989a3d4bc2bd81d57d6324ca8cb06341c35fb94db73a092edbed2a9c56df43924fa3160ff2fc1c6801fd2fa41dd0072bd1ac198f585f86a1267ee9ca59106072de1b31428c364795757adee6b84ac9c1c942d8fad7540568e226a45c483133be2659f816a5a29670fb44a849e0d764259b18b3adacd72b6d7d21b93f7a9ee4f1fcdcf241008d6a1fdebf871bcfbf80007e3e061d036f41ffe3697fe0941634a3d0a524bcb6ac07cd3bd4ee2662875520931f4229c7aaffeb5a26733bb178877c5d7875b65627f0467a074f0dca5ccb5a8defb31ec82674766d91904be44752a44ea24b9895c7a300c511729cfcd0c6a238973276e6dee3b7fdd010fbf33c46a09e76fd645c2c6fc717e2e5f7f68b0698083089fb5c490f78cf5e9a12ffabc70800cfb29ae4b0f2e996495c8ad4c55313ece884ca3f311e7b7166206cb9b7cb3e04aea898f8f3ed1b836c55362f9cd6b3fc9bc938e12b30b363197a08a32fc43a8130c9bf9acc0721df090888954677d5771b5c07ad8b3d75242a87ac8dd921fee58f79bef917ac90144641b7795e74dde792b8c02dca3708fa168d898f1bd81f7c1b152ec49cafabfc0f758834c596216385200fe19197ade00dd4339bfbb9936215de67c0ce4900aea55adaa59316c6be82040bc76e8a36ea140b7f1ead8058a1659d673b23a97819fd8e5160a7581e6c967c2cc8715c25fa5fc286fb0db1c22c60550f479175adacb2dbac38d4df3d4040f7eebd0e8e3c90e2e51ce201e07a37de659675fb2662a2b0864bed3b02141caa3bc619c58c8905c629d84533d0a7359f676dadf09c6856b46b5672481f1d45347f78bc36710ddb3e78757d1172d29d877824355f33a0a7f950419b36287fb5dd268ea4efa4445b585fdc1feaba0abcb6421f6ea751a74d3148c0a8bb50a6707df19c538d6504ac7393f4949b11b628671ff36cc57ac99a26fdc9d53e1301b8be991943fd3f83d39c0f4a8b583e5503969dcda0099fdaecc0624179dda288a8512d3dd5b89d1205d0bdb075fe60090da114d32151178f786cd5a154fb44f7b34e4a782beffee2fb5ccf403e81d2d790bd339e5ffccaa72b11def817e5cd8b57ab72ea546c4d6dc710e370716f06d11fc2e7a756aa3b6578fc545529917a5cccd71c19bdfaeb13eddc15d2482c3c3da7649cee63eac2340358855175951e7561df38fba25a363e17df828fd030ca764d83b2682a0446c5f80dd249e854a5c166f5e47befd349f1a0d5bc12e37df6359d6df8c76f6396c7ab46b544ae54a4620bb6f45ebf548dd9fbf2b3dd64d33bd37d1a7da47fcf46a4ba14b51e30c1252dfdeb2334d6b719708f80c3e245ef54ddb0d9ca00f59758bda5c8f10fbe9465d8dac6b62527b46b3bd94a8933613510f71bd028c40e6ac540ddb7b0a21be47c58204022b9da59c4abae089290b8424ce3e923e90d290342c8a285aacb88936380930f1e4f431283cea63b8689049735cd1027a18543059c1acc8a9b2f2162db3351bf86aec71d4ab9a9a672646bc53fb487de5775e2f7d772c736e6e397e221adf88669778f69855b8cc062163993b602122202215eea6db69b4b0e1c0c884b448f22ebcc5b74323f86d4dd3e35997f46cca6a58dd9768925bcf5c041fc988511edf72531b7ce40f639e0588128c10ceecba6c7f3e0b4781ccd883a9b4d15493df45701456bc3c0b23c21ccb286d4daf60f481118974dcb38246e023ef7b118f1993efaf1bf5e94908219413fa531979d52d7f76af5755c90321e9b71af6379a0d20560db271aa10a5718f831de4e166e1894fa3f9cb91d88271bad1d7fd525adeb73390294c6dc0df3c8e669b98946e3680969596a5a2205e5cf7d4cf64274ab9d60f1ef574d1c9418fa4149a8212da40f9cafce745368e7d5cfb89fca705d58289ab3cc0589f4999690cdd9af0594e4281464cb3df3f3259e8f394919be255d24ddf59187720f3aa8dc2fbd6bfce37d3b30773d75ebb9513fce36cd99713c9578e7410058743a202c754ca1e2d7f1da2265a5de089278d2fa99c8df142704fb4f8e76220f497a8543f29549f09d4e3ba785e2cd2c69083d1b32d5c59eba2931ee1ceed14aa9535da717efba927684a1c68b39598d057201e5c68bb9480712eeb8aefa573103d3d08d9a90334961727e009704bf10b46ba1d21b56b4d792470b6c92c38541e2744882dad49746e307cab9760f9ac7cda349e04f2f179e1fe91c9c25a2221ff0b4dcb1bd09be1cc1857ac312c449b0d2cf5a872b2f1de71b39d2977f908077d66a977257c9d84ddeb9c8bd4904de8e8cb4525af772f76e5d17e10ce768894093e53c121860836cecc8095bbe047f330f1acf2d8420f58396cf6de8f3fccc5a162b9d22685b682a24b1b00b844612911e5bbecc3ece26c7de6924c69fd7eec58e1ee89157510b47865a910bf6984639b2d25a8a1e3388315474059da1bc8ad3068278499cc12e3ef148d2d4bee05b36a97c30b3e055bad11e334d24be13df8d29312502a1f93fc21c5bfaf6dafd0a37299ac9ed04b3522a064d04b816fce88c6dfe3cbb789f821f4183c71af82dbae3a093a44cb2db8e3fabed7da67fc0d7c3bfb43418d1cbbdc3622b45b7fcdf4954ae75590e8dedd52df490b772d6aa005acad57967779bfa0aa40d812fdb362fb6da3ef44d0f8be878ff5cfd7311a10c998e2ffe518d06876dd7e3d89f882ba9e34a821e636ebbc90f113f43c9cd0e5d73daee69e7ba2950ae6c7200c275c0efd435aa3dc9c77a6a96c16d3c37fab07f30c4dbf3ab256a2ae497576f35fa2918fe3c179d56a30d6dd74812f447f76e302602b3f6d0af7659b9434ab62d362bd2dd9489f977d62f0abcd1b87514aee180521d8b63e498fd8edd037ff7b7468eb9c042af0a76cfd1ef5e7a7a5b1169b8c07fb5dca65c6f049a464110205c93b6bc04d63e3e4449c98b5c23e5caa436af2f23116b7b0a6fae767c21ad22c73120c93d7cfb57b2946de90ee4ca0d726a4e20988e072bb7f7cc92cecaeb2ac73158ab658910531c65f7c9c4f923a017b491e96dcd049bd7461076d263f47a981feb8bb7d17dafc3c292db9f9096bc77b9630720b8fa8fd26aa61b707e7413443ed5075b6665eb795f1d87c171fefff65bb9274490a3d87bc2e7b14f54640bc70045e69d8b4347e067dfafcb074f73f421c465cf1a68e283371f36e759225a401dc3f72ebc7dd95a826cc193052ba88629e7c281e46eea52ed1bbe24610efa2c0efa43a372b6148d1f6dc622529e2bbe78291a66aba2df5d0f6fcfd789d46c21d9bafa4c221671005a43bc2651087e90fab2f193ba39c4f3b778a6ea6b8782cf96c054c80484405640a1dcc714cff8b7e956ed0a12f167e2b2a3cdee51f04ddec44e740cb31adb79e85e3a5a8bbb5408c4812b96009f553143966824fd2bbf12033fc54a668b2f59c25d54a04860a1177c7cef98152231c042640b3112f21955a63a7c2f443f1b9d0d9c144798380422887ec91cfef6822a7bcc31339331a3212b5af00826a110f378dbe80aa6005922d221e632d9b7254d509509ea706d16d52c7dbd2a686df823f163d5e74887edfb283b289f6cc6cd2f36edaa49779eb24eb3d6cdc922c7ebf3ecfa38e94e40da1f581e308559fc59b826ad9605a2da6b0cda408fca34338935097ec0644c8b618b31532fe5c7febfb2fc69753cca0cec49a5db84225666b10927faa0213102bd6526e9bb190345ce478c5cc18ab40ef14b12f4c0faa900c8e31fa425f22f6e5a0db02ee13c19bc1d88e1856b97cdffb464591381aa17054ba06e9a03aeeff5ba56a8b35c4121519d3819a2d523307d93f1d9ef2137abd3867d793decf44a3a9568863ff867e666c1531a7c1519e49edf96b2a97aad28069ef4a551fd04b319ebb6af2cb3cbfb76bffb3277565a584db34ad6fe00ef6b3969a6c6c36ccca28c9ba867b21c741f25f096aafb1daad8584e9dca74d6cb4f0b7595a35d2cdd52be1cd1ff8853e42009c7a477edd9f981f03a80d5f1409edf7b27bb382b151c1877fb3a8e5e8f01ba948021efa8667a9c87cc931728a43436b7058798ea89832f436e1383819b2aa9ab09bb2850acd5c69a9f7c08b2ad16230c1ec318b9deaa8ac5f577a7917c9cf3a93b0756c689d03ba46c18278063ecd73358ef1cd6439787b64274ace1c456975fba0cbcf9546afd6abde54b128b109e8ece91b75dce24d1786a4ca811ef48293da813760862feea262007abd4b85ba6f24c80c3617b810247b90d649260619285ca3785473b3c3326d0c9e4737aafd2791eeb4d17830d960c41692f9e2a022b28efaef3cf69dcd90c62d290be28652cb09e3888193e5e3a8534b77962be414d496338570d6757079a49a3c4513ed3e15799690fbfe806456f09a6bc49aec9de8394f2521346d703cec26a3d03179902d0eff79edb6576af6fbe7829382b408a7219c1a31b941b77c17dae1db72e4e835ac8c84e4e8e23ccdc34351722aa883cd3999fb57b8d75efddc19c409692062f7163b86a17208c20c1b21079302306657d380e6b5cd47c758a7e0e1945ae86beaaf4ca4b4ca705854e7067429fc089d1982a8f3bbf4232f36b80c953d7ba2daad38a31c46a4130579da6623964567276465f3cfc91f28ee3f0df1e1927fbeb147f0ff588b82455ef4bfe68ac38f55ce9b4020caca71fb8a2a8f6aa77e234ea7c14a59b89d1c6dc2723921ba92052070e4a005ea5a3ffc78be9eaca22a8b8e66e8e20928dad3310504093df3133febee578feca730b5c6f0fe4dc4142310b012c4ec68ebab17be1621d60b1f23103978cdda9f86539f4e79befdd08113aeb8af5ea226302e768f1e870140f658faf35947b12460e6bc5f88de9cc3fcfce0bc0796154e434b0018b4b025a8a8bbbc61efb8cf1e954f0bcb5d971f50fc9c536b0f803b133f9cfcc90c36d7f3afc37547a174b7c7f422fc6aee089e0601c364998b45231a1f868db7d339be008886eaa8e65ba4a23facff96e984f42fc204f4563aedf84075dd8c914ee906b7e5f3cc857739f2266d792c85d90954258ef7f7086227235fe3db1dc48c93f76fbed200955ada119bb110dd14b54ac77b8593fef2b06272e839003fe68fe4d8ac44512c98defe769e896e303e32980e449cd1e2767f51a644aafc189e2a12fcda834fd4854f798e69fa5f9e8ff3eb5c8a43621a2a555b48300af80fff749e58572a268e51c0dd26ce7a91966fc02a9466e1654a