CVE-2024-50347: Laravel Reverb API Signature Verification Bypass
Summary
CVE-2024-50347: Laravel Reverb Missing API Signature Verification. Affects laravel/reverb versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel Reverb is a package designed to facilitate real-time event broadcasting and communication through a Pusher-compatible API. It allows developers to send messages from backend services and gather statistical information about channels. However, it has been found to have a critical vulnerability related to the verification of API signatures, which could potentially allow unauthorized access to sensitive operations.
Vulnerability Detail
The vulnerability arises from the absence of verification for request signatures sent to Reverb's Pusher-compatible API. This API is crucial for broadcasting messages and obtaining channel statistics. The signature, which is a hash generated using the app's secret key, is not being validated, making it possible for attackers to exploit this flaw if they know the application ID. The affected endpoints include POST /events, POST /events_batch, GET /connections, GET /channels, GET /channel, GET /channel_users, and POST /users_terminate. This could lead to unauthorized actions being performed on behalf of the application.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
composer require laravel/reverb:1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that the application ID is not exposed in any public-facing code or client-side scripts. Additionally, consider implementing additional server-side checks to validate the source of incoming requests until the package is updated.
Conclusion
The Laravel Reverb package has a significant vulnerability related to API signature verification that could allow unauthorized access to critical operations. It is essential to update to version 1.4.0 or later to mitigate this risk. Users should also take precautions to protect their application ID and consider additional validation measures until the update is applied.
See every vulnerability recorded for laravel/reverb →
FAQ
CVE-2024-50347 is a vulnerability in the Laravel Reverb package that allows for the bypass of API signature verification, potentially enabling unauthorized access to sensitive operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to API endpoints, which could lead to data breaches or manipulation of application behavior.
Yes, a patch has been released in version 1.4.0 of the Laravel Reverb package, which addresses the signature verification issue.
If an immediate update is not possible, ensure that your application ID is kept confidential and implement additional server-side checks to validate incoming requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/reverb.
