# CVE-2017-16894: Laravel - Information Disclosure

> Live exploitation tracking for CVE-2017-16894 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2017-16894

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Laravel/framework
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** web_application

## Description

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

## CrowdSec analysis

Information Disclosure in Laravel, [CVE-2017-16894](https://euvd.enisa.europa.eu/vulnerability/CVE-2017-16894) exposes a vulnerability in Laravel framework through version 5.5.21, where remote attackers can access sensitive information, including passwords, by directly requesting the /.env file. This flaw arises from improper file permission handling in the writeNewEnvironmentFileWith function, potentially leading to credential leakage and facilitating further attacks such as unauthorized access or privilege escalation.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of December 2023.

CrowdSec network data shows that most actors exploiting CVE-2017-16894 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2017-16894 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2017-16894 is currently experiencing high visibility and active exploitation across the internet.

Attackers attempt to access the `.env` file at the web root to obtain sensitive Laravel configuration data, including application secrets and credentials.

## Timeline

- 2017-11-20: CVE Published. CVE-2017-16894 is published to NVD.
- 2023-12-22: Rule Released. CrowdSec releases a rule to detect CVE-2017-16894 exploitation attempts against the CrowdSec Network.
- 2025-09-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2017-16894 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16894.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2017-16894) follows observed exploitation activity for CVE-2017-16894. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.