CVE-2024-55661

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-55661
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55661.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-55661
Aliases
Published
2024-12-13T16:15:27Z
Modified
2025-01-15T05:16:35.733032Z
Summary
[none]
Details

Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public remember() method in the Laravel\Pulse\Livewire\Concerns\RemembersQueries trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is remember(callable $query, string $key = '') method in Laravel\Pulse\Livewire\Concerns\RemembersQueries, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch.

References

Affected packages

Git / github.com/laravel/pulse

Affected ranges

Type
GIT
Repo
https://github.com/laravel/pulse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

v1.*

v1.0.0
v1.0.0-beta1
v1.0.0-beta10
v1.0.0-beta11
v1.0.0-beta12
v1.0.0-beta13
v1.0.0-beta14
v1.0.0-beta15
v1.0.0-beta16
v1.0.0-beta2
v1.0.0-beta3
v1.0.0-beta4
v1.0.0-beta5
v1.0.0-beta6
v1.0.0-beta7
v1.0.0-beta8
v1.0.0-beta9
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.3.0