CVE-2024-55661

Description

A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. ### Impact An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria: - The callable is a function or static method - The callable has no parameters or no strict parameter types ### Vulnerable Components - The `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries` - Affects all Pulse card components that use this trait ### Attack Vectors The vulnerability can be exploited through Livewire component interactions, for example: ```php wire:click="remember('\\Illuminate\\Support\\Facades\\Config::all', 'config')" ``` ### Credit Thank you to Jeremy Angele for reporting this vulnerability.

How to fix CVE-2024-55661

To remediate CVE-2024-55661, upgrade the affected package to a fixed version below.

• —upgrade to 1.3.1 or later

Is CVE-2024-55661 being exploited?

Moderate — EPSS is 28.6%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• from 0, < 1.3.1

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-55661
• PATCHgithub.com/laravel/pulse
• WEBgithub.com/laravel/pulse/commit/d1a5bf2eca36c6e3bedb4ceecd45df7d002a1ebc
• WEBgithub.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2