SB2024100896 - Improper input validation in Livewire

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper input validation (CVE-ID: CVE-2024-47823)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the file upload handling functionality when processing uploaded files. A remote attacker can upload a specially crafted file with a valid MIME type and a .php extension to execute arbitrary code.

Exploitation requires that the application uses the original client filename, stores uploaded files directly on a public storage disk, and runs on a webserver configured to execute .php files.

Remediation

Install update from vendor's website.

References

• https://github.com/livewire/livewire/security/advisories/GHSA-f3cx-396f-7jqp
• https://github.com/advisories/GHSA-f3cx-396f-7jqp