Security breach from contact form in Laravel 5.8.36?

Question

the most bizarre thing happened, someone fount out the smtp mail driver credentials from a Laravel project, which are stored in the .env.

The credentials are used for a contact form. The .env was in production and the debug was set to false APP_DEBUG=false. The location of the .env was never changed so it is not a public file.

Any suggestions how can one get the credentials? I am using re captcha to prevent spam mails.

Contact controller:

public function sendMail(SendContactMailRequest $request)
    {
        $email = FormEmail::whereId($request->department)->firstOrFail();

        \Mail::send('emails.contact', [
            'name' => $request->name,
            'email' => $request->email,
            'phone' => $request->phone,
            'subject' => $request->subject,
            'form_message' => $request->message
        ], function ($message) use ($request, $email) {
            $message->from($request->email, $request->name);
            $message->to($email->email)->subject($request->subject);
        });

        return redirect()->route('contact')->with('message', __('custom-form.success-message'));
    }

Answer 1

there is lot of possibilities here:

• you are on shared hosting ( weak one ) which had another website hacked and that lead to your files.
• you have another cms on the same account ( wordpress, magento, ...etc ) that has been hacked and lead to your files.
• you have SQL injection vulnerability in your code which lead to your database then your admin access then your files.
• you have upload field in any contact form which is not secured and lead to upload a shell.

Answer 2

If your server is breached, it can be through many means. You might have a SQL injection for example in a part of your application or if your OS is unpatched, they could find a way to get in. It could well be a brute force credential guess too. Your SMTP might have its own security issues as well. You need to dig into your logs, especially web server logs if you suspect they accessed it through your web application and also SMTP server logs. The code you posted here seems straightforward and unlikely the route they took.