ExploitPublished 9 Jun 2025

Laravel Pulse 1.3.1 · Arbitrary Code Injection

Source Exploit-DB RSS Feed

Mentioned vulnerabilities

CVE-2024-55661

Severity

Medium

Rated by Threat Radar

Data as of 15 Jun 2025, 05:35 UTC

What to do

AI-suggested

1. Immediate upgrade to Laravel Pulse version 1.3.1 or later where the vulnerability is patched. 2. If upgrading is not immediately feasible, restrict access to Livewire endpoints via network controls such as web application firewalls (WAFs) or IP whitelisting to limit exposure. 3. Implement strict input validation and sanitization on Livewire components to prevent invocation of unsafe methods. 4. Employ runtime application self-protection (RASP) tools to detect and block suspicious dynamic method calls. 5. Monitor web server logs and application logs for unusual POST requests to Livewire endpoints, especially those invoking the `remember()` method. 6. Use Content Security Policy (CSP) headers and disable unnecessary Livewire features if possible. 7. Conduct thorough code reviews to ensure no unsafe classes or methods are exposed to Livewire components. 8. Deploy intrusion detection systems (IDS) tuned to detect exploitation patterns of this vulnerability. 9. Educate development teams about secure usage of dynamic method calls in Laravel Livewire components. 10. Regularly scan web applications with vulnerability scanners that include checks for Laravel Pulse vulnerabilities.

Description

Laravel Pulse 1.3.1 - Arbitrary Code Injection

Impact

For European organizations, this vulnerability poses a significant risk to web applications built using Laravel Pulse prior to version 1.3.1. Exploitation can result in full remote code execution, allowing attackers to execute arbitrary commands, deploy malware, exfiltrate sensitive data, or pivot within the network. This can lead to data breaches, service disruption, and reputational damage. Given Laravel's popularity in Europe, especially among SMEs and startups, organizations using Laravel Pulse components in their web infrastructure are at risk. The vulnerability's ease of exploitation without authentication increases the likelihood of automated scanning and exploitation attempts. Critical sectors such as finance, healthcare, and government institutions relying on Laravel-based applications could face severe operational and compliance impacts, including GDPR violations due to data exposure. Additionally, the exploit could be used to establish persistent backdoors or launch further attacks within corporate networks. The absence of known exploits in the wild currently suggests a window for proactive mitigation before widespread exploitation occurs.

Indicators of compromise

Exploit source code

Exploit code for Laravel Pulse 1.3.1 - Arbitrary Code Injection4,836 characters

#!/usr/bin/env python3
# Exploit Title: Laravel Pulse 1.3.1 - Arbitrary Code Injection
# Author: Mohammed Idrees Banyamer (@banyamer_security)
# GitHub: https://github.com/mbanyamer
# Date: 2025-06-06
# Tested on: Laravel Pulse v1.2.0 / Ubuntu 22.04 / Apache2
# CVE: CVE-2024-55661
# Type: Remote Code Execution (via Arbitrary Code Injection)
# Platform: PHP (Laravel Livewire)
# Author Country: Jordan
# Description: 
#   A vulnerability in Laravel Pulse (< 1.3.1) allows arbitrary code injection vi…

References

Community reviews

Loading reviews…