Laravel Security: "Androxgh0st" Malware Targeting Laravel apps?

TL;DR → You’re only vulnerable if your .env file is web-accessible or you have debug-mode enabled, and the RCE relies on an outdated version of Laravel.

A bunch of news articles have popped up over the past couple of days talking about the new “Androxgh0st” malware that has been specifically targeting Laravel apps1. To avoid folks getting the wrong idea that “Laravel is insecure”, or that all Laravel apps are being targeted, I wanted to send out a special Laravel Security Notice to explain exactly what’s going on with this malware and what conditions need to be met for it to compromise your site.

The Vulnerability

On 16th January 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory titled “Known Indicators of Compromise Associated with Androxgh0st Malware”. Check out the advisory if you’re interested in the full details, but here’s the summary of the attack:

1. The malware scans for Laravel apps on the internet.

2. After finding a Laravel app, it checks for exposed `.env` files to steal the credentials and API keys.

3. It may also send a `POST` request with the variable `0x[]` to trigger an error, looking for sites with debug mode enabled, which can also expose credentials and API keys.

4. If it’s successful in accessing the application key, it’ll attempt to exploit a known Remote Code Execution (RCE) vulnerability in Laravel v52 with the `X-XSRF-TOKEN` cookie.

The primary target is to steal app credentials and API keys, which would allow the attackers to gain access to any third party services your app uses, with a secondary bonus of getting RCE to execute malicious code - typically to run a shell and build the botnet.

Is Your App Vulnerable?

To be vulnerable to this malware attack, your app needs to have either:

1. Exposed .env File
   The only way this is possible is if Laravel has been incorrectly installed entirely within a web-accessible directory (usually a subdirectory), so all of the files, including .env are web-accessible - rather than just the public/ directory, as is the intended default.
2. Debug Mode Enabled
   i.e. `APP_DEBUG=true` in your .env file.

At this point, your app is compromised and your credentials/API keys have been stolen.

The malware then attempts to exploit a known RCE vulnerability to gain remote access/shell to the server for further compromise. They’ve recorded it as using a v5 RCE, however any other RCE or weakness in older versions of Laravel could be exploited effectively here too.

Therefore, your app is not vulnerable if:

1. .env isn’t accessible.
2. Debug Mode is disabled.
3. Laravel kept updated to v9 or v10.

From what I’ve seen, the majority of Laravel apps are not vulnerable, especially any that are actively maintained. This would primarily affect old and abandoned apps, which were never properly installed or managed.

Preventing The Vulnerability

There are a few steps you should take to ensure your Laravel apps are safe:

1. Protect Your .env File
   Ensure your .env file is outside the web-accessible directory, or if you can’t do that, configure Nginx/Apache to block access to dot files (.*).

Disable Debug Mode on World-Accessible Apps

Ensure you keep debug mode off on world-accessible apps - which includes staging and testing sites. Debug mode leaks all sorts of sensitive information, and triggering errors is fairly easy.

1. Keep Laravel Updated
   Ensure you keep up with Laravel releases and are always using a supported version. As of writing, that is v10 for bug fixes, and v9 for security fixes. Anything older should be considered insecure and a risk.

If you do these three things, then your app is safe from this malware. They are also pretty standard checklist items, but as we’ve seen by this malware targeting Laravel, a reminder is always a good idea!