CVE-2024-55661
📋 TL;DR
CVE-2024-55661 is a remote code execution vulnerability in Laravel Pulse monitoring tool. Authenticated users with dashboard access can execute arbitrary PHP code through the vulnerable remember() method. This affects all Laravel applications using Pulse versions before 1.3.1.
💻 Affected Systems
- Laravel Pulse
📦 What is this software?
Pulse by Laravel
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attacker to execute arbitrary commands, access sensitive data, modify application code, and pivot to other systems.
Likely Case
Unauthorized code execution leading to data theft, privilege escalation, and persistence mechanisms installation.
If Mitigated
Limited impact if proper authentication controls restrict dashboard access to trusted administrators only.
🎯 Exploit Status
Exploitation requires authenticated access to Pulse dashboard. The vulnerability allows calling arbitrary callables with minimal technical complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1
Vendor Advisory: https://github.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2
Restart Required: No
Instructions:
1. Update Laravel Pulse to version 1.3.1 or later via Composer: composer require laravel/pulse:^1.3.1
2. Run composer update
3. Clear Laravel cache: php artisan cache:clear
4. Verify the update completed successfully
🔧 Temporary Workarounds
Restrict Dashboard Access
allLimit Laravel Pulse dashboard access to trusted administrators only using middleware or authentication gates.
Disable Pulse Components
allTemporarily disable Pulse card components that use the RemembersQueries trait until patching is possible.
🧯 If You Can't Patch
- Implement strict network access controls to restrict Pulse dashboard to trusted IP addresses only.
- Enable detailed logging and monitoring of all Pulse dashboard access and unusual PHP function calls.
🔍 How to Verify
Check if Vulnerable:
Check composer.json or run: composer show laravel/pulse --direct | grep versionCheck Version:
composer show laravel/pulse --direct | grep versionVerify Fix Applied:
Confirm version is 1.3.1 or higher: composer show laravel/pulse --direct | grep version📡 Detection & Monitoring
Log Indicators:
- Unusual remember() method calls in application logs
- Suspicious PHP function executions from Pulse components
- Multiple failed authentication attempts to Pulse dashboard
Network Indicators:
- Unusual outbound connections from Laravel application server
- HTTP requests to Pulse dashboard endpoints from unexpected sources
SIEM Query:
source="laravel.log" AND ("remember()" OR "Pulse" OR "RemembersQueries") AND (severity="ERROR" OR severity="CRITICAL")