CVE-2025-53833 Scanner

LaRecipe is a documentation creation application commonly used by developers and organizations for creating and managing technical documentation within Laravel applications. It employs Markdown for ease and flexibility. Integral to development environments, LaRecipe allows teams to maintain consistent documentation practices, ensuring information is up-to-date and accessible. The software is utilized globally by developers seeking a streamlined, integrated documentation solution within their Laravel framework. By offering a simple setup and an intuitive interface, LaRecipe enhances documentation workflow and improves team collaboration. This application is a pivotal component of many development teams' toolkits, emphasizing its widespread use and importance.

Server Side Template Injection (SSTI) is a critical vulnerability that allows an attacker to inject and execute code on the server through web application templates. This vulnerability arises when user inputs are concatenated into web application templates without sufficient validation or sanitization. As a result, attackers can inject malicious template expressions that the server executes, leading to remote code execution. In the context of LaRecipe, the vulnerability is present in the Markdown rendering functionality, where user-supplied content is processed without proper escaping.

The specific vulnerable endpoint is the documentation rendering route, where Markdown content is passed to the Blade template engine. The parameter 'content' or similar input fields are not sanitized before being rendered, allowing an attacker to inject Blade template syntax such as {{7*7}} or more complex expressions. This injection occurs because LaRecipe directly passes user input to the template engine without using the appropriate escaping functions, enabling the execution of arbitrary code on the server.

If exploited, an attacker can achieve full remote code execution on the server, potentially gaining complete control over the application and underlying system. This could lead to data breaches, unauthorized access to sensitive information, and further compromise of the infrastructure. Given the CVSS score of 10.0, this vulnerability is considered critical and requires immediate attention to prevent severe security incidents.