CVE-2024-50347

Executive Summary

CVE-2024-50347 is a vulnerability in Laravel Reverb, a real-time WebSocket communication backend for Laravel applications. The flaw resides in the Pusher-compatible API endpoints, where verification signatures for incoming requests were not being validated. This allows an attacker with knowledge of the application ID to send unauthorized requests to these endpoints, potentially enabling actions such as broadcasting messages or retrieving channel statistics. The vulnerability does not affect the WebSocket connections themselves. The issue is fixed in version 1.4.0.

Supply Chain & Package Security

This vulnerability affects the Laravel Reverb package, which is distributed via Composer (PHP). Organizations using Laravel Reverb should verify their dependency version and update to 1.4.0 or later. The package is a critical component for real-time features in Laravel applications, and exploitation could lead to unauthorized data access or manipulation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the description, a more realistic score would be 5.3 (Medium).
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N) – but requires knowledge of the application ID.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential to read channel statistics.
• Integrity Impact: Low (I:L) – potential to broadcast unauthorized messages.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires knowledge of the application ID, which should not be publicly exposed. However, if an attacker obtains this ID, they can perform unauthorized actions.

Deep Dive & Mechanics

Laravel Reverb provides a Pusher-compatible API for server-to-server communication. This API is used for tasks like broadcasting events or querying channel information. The vulnerability arises because the API endpoints did not verify the signature included in requests. In Pusher's protocol, each request includes a signature generated using the application's secret key. Without signature verification, an attacker who knows the application ID can forge requests.

The affected endpoints include:

• /apps/{appId}/events – for broadcasting events.
• /apps/{appId}/channels – for listing channels.
• /apps/{appId}/channels/{channelName} – for channel information.
• /apps/{appId}/channels/{channelName}/users – for user presence.

An attacker could send a crafted POST request to the events endpoint to broadcast arbitrary data to all connected clients, or query channel statistics to gather intelligence.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.4.0): The signature verification middleware was missing or not applied to the Pusher-compatible API routes.

// In routes/channels.php or similar
Route::post('/apps/{appId}/events', [PusherController::class, 'event']);
// No middleware to verify signature

Patched Code (1.4.0): The patch adds signature verification middleware to all Pusher-compatible API routes.

// In routes/channels.php
Route::post('/apps/{appId}/events', [PusherController::class, 'event'])
    ->middleware('verify-pusher-signature');

The middleware checks the X-Pusher-Key header and the auth_signature parameter against the expected signature computed using the application's secret.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Knowledge of the application ID (e.g., 123456).
• Network access to the Reverb server (e.g., ws.example.com).

Exploitation Steps:

1. Identify the Application ID: This may be leaked in client-side code, error messages, or through other reconnaissance.

2. Broadcast an Unauthorized Event:

   curl -X POST https://ws.example.com/apps/123456/events \
     -H "Content-Type: application/json" \
     -d '{
       "name": "my-event",
       "data": {"message": "Unauthorized broadcast"},
       "channels": ["public-channel"]
     }'
   

3. Query Channel Statistics:

   curl https://ws.example.com/apps/123456/channels
   

Note: No public exploit code is available for this vulnerability.

Blue Team

Detection:

• Monitor for requests to /apps/{appId}/events or /apps/{appId}/channels that lack the X-Pusher-Key header or have an invalid signature.
• Alert on multiple failed signature verification attempts.

Hunting:

• Search logs for requests to Pusher-compatible API endpoints without proper authentication headers.
• Review application logs for errors related to signature verification.

Indicators of Compromise (IOCs)

• Network:

  • Requests to /apps/{appId}/events without X-Pusher-Key header.
  • Requests to /apps/{appId}/channels from unexpected IPs.
  • Multiple 401/403 responses from Reverb API endpoints.

• Logs:

  • Log entries indicating "Signature verification failed" or similar.
  • Unusual event broadcasts on channels that should not be accessible.

• System:

  • Unexpected changes in channel statistics or user presence data.

Detection Engineering

YARA Rule

rule CVE_2024_50347_Laravel_Reverb_Signature_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2024-50347 in Laravel Reverb"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-50347"
    strings:
        $s1 = "/apps/" ascii
        $s2 = "/events" ascii
        $s3 = "/channels" ascii
        $s4 = "X-Pusher-Key" ascii nocase
    condition:
        any of ($s1, $s2, $s3) and not $s4
}

Sigma Rule

title: CVE-2024-50347 - Laravel Reverb Signature Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to Laravel Reverb Pusher-compatible API without signature verification
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem|startswith: '/apps/'
        cs-uri-stem|contains: 
            - '/events'
            - '/channels'
    filter:
        cs-headers|contains: 'X-Pusher-Key'
    condition: selection and not filter
falsepositives:
    - Legitimate requests from authorized services
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50347 - Laravel Reverb Signature Bypass Attempt"; flow:to_server; content:"/apps/"; http_uri; content:"/events"; http_uri; distance:0; content:!"X-Pusher-Key"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Laravel Reverb to version 1.4.0 or later.
• If immediate upgrade is not possible, restrict network access to the Reverb API endpoints to trusted IPs only.

Long-term:

• Implement API key rotation and ensure application IDs are not exposed in client-side code.
• Monitor logs for unauthorized API access attempts.
• Conduct regular security audits of real-time communication components.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence expert. For further assistance, contact Valters IT.