CVE-2024-55661: Laravel Pulse Remote Code Execution Vulnerability
Summary
CVE-2024-55661: Laravel Pulse Allows Remote Code Execution via Unprotected Query Method. Affects laravel/pulse versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel Pulse is a package designed to enhance the Laravel framework by providing a dashboard for monitoring and managing application performance. It integrates seamlessly with Livewire components, allowing developers to create interactive user interfaces. However, due to a flaw in its implementation, Laravel Pulse is susceptible to a remote code execution vulnerability that can be exploited by authenticated users.
Vulnerability Detail
A vulnerability has been identified in Laravel Pulse that allows remote code execution through the public 'remember()' method in the 'Laravel\Pulse\Livewire\Concerns\RemembersQueries' trait. This method is accessible via Livewire components and can be exploited to invoke arbitrary callables within the application. The vulnerability arises when an authenticated user can execute arbitrary code by calling any function or static method that has no parameters or no strict parameter types. This could lead to severe security breaches, as attackers could manipulate the application to execute malicious code.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
composer require laravel/pulse:1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Laravel Pulse dashboard to trusted users only, thereby minimizing the risk of exploitation until the package is updated. Additionally, you can implement input validation to ensure that only safe callables are executed.
Conclusion
The CVE-2024-55661 vulnerability in Laravel Pulse poses a significant risk by allowing remote code execution through the 'remember()' method. It is crucial for developers to update to the latest version of the package to safeguard their applications. Implementing workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for laravel/pulse →
FAQ
The vulnerability allows authenticated users to execute arbitrary code through the 'remember()' method, which can lead to remote code execution.
Any application using Laravel Pulse with Livewire components is potentially affected, especially if it allows untrusted users access to the dashboard.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your composer.lock file, you can receive real-time alerts. You can also check your application using the Vulert playground without any signup.
If an immediate update is not possible, restrict access to the Laravel Pulse dashboard and validate inputs to mitigate potential exploitation.
Exploitation of this vulnerability could lead to unauthorized access, data breaches, and the execution of malicious code within the application.
