They’ll iterate over lists of IPs, domains, and paths until they get lucky and find a website that either had the debug mode still enabled, or left the. Granted, they don’t know all of the websites that are vulnerable to this attack, but that doesn’t stop them. Once that happens, they’re greeted with the debug page, and the sensitive information is then scraped and either used or sold. If debug mode isn’t turned off when an application is in production mode, an attacker can trigger an exception by using a specially crafted payload in an HTTP request. But how do the spammers find this information? spammers), then you can bet your bottom dollar that there will be unwanted messages soon flowing through the compromised mail server. Well, if this sensitive information is available and gets in the hands of the wrong person (i.e. When this happens, sensitive information like passwords, keys, and database information can be exposed when an exception occurs, like the screenshot below shows. The problem arises when the web application goes live and debug mode is not turned off.

That, by itself, isn’t a problem because this is usually something only used during development. Laravel includes a debug mode that helps those developers find problems and identify errors in their code while developing a web application.

Laravel is a very popular PHP framework used by developers around the world. Our investigation found the usual culprits like the accidental exposure of credentials on Github and credential stuffing attacks, but what we hadn’t seen before was something that affected our customers using Laravel. This isn’t anything new, but the current increase did give us pause, so we decided to investigate. And yet, security breaches and compromised accounts are becoming far too common, and compliance and security teams are constantly racking their brains to identify vulnerabilities and how to prevent them.Īt Mailgun, we've recently noticed an increase in the number of customer accounts with unauthorized use on them. 'Is my application secure?' is one of the top questions developers ask themselves nowadays.

Debug code for breeding season 6.6.1