CVE-2024-47823: laravel livewire Improper Input Validation

Vulnerability summary

CVE-2024-47823 is a critical (CVSS 9.8) Improper Input Validation vulnerability in laravel livewire. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-10-2024
   PublishedVulnerability first disclosed.
2. 17-07-2025
   Last modifiedVulnerability information updated.

Description

Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack: 1. Filename is composed of the original file name using `$file->getClientOriginalName()`. 2. Files stored directly on your server in a public storage disk. 3. Webserver is configured to execute “.php” files. This issue has been addressed in release versions `2.12.7` and `3.5.2`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.