CVE-2024-55661

描述

A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. ### Impact An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria: - The callable is a function or static method - The callable has no parameters or no strict parameter types ### Vulnerable Components - The `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries` - Affects all Pulse card components that use this trait ### Attack Vectors The vulnerability can be exploited through Livewire component interactions, for example: ```php wire:click="remember('\\Illuminate\\Support\\Facades\\Config::all', 'config')" ``` ### Credit Thank you to Jeremy Angele for reporting this vulnerability.

如何修補 CVE-2024-55661

要修補 CVE-2024-55661,請將受影響套件升級到下列已修補版本。

• —升級至 1.3.1 或更新版本

CVE-2024-55661 正在被利用嗎?

中等 — EPSS 為 28.6%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 1.3.1

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-55661
• PATCHgithub.com/laravel/pulse
• WEBgithub.com/laravel/pulse/commit/d1a5bf2eca36c6e3bedb4ceecd45df7d002a1ebc
• WEBgithub.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2