CVE-2024-50347

Laravel Reverb has Missing API Signature Verification

Published: Oct 31, 2024Updated: Nov 1, 2024 Sources: CVE List NVD GHSACWE-347

N/ACVSS

NVD MITRE

Description

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0.

No summary for this CVE yet.

Weaknesses

CWE-347

Affected Products

laravel

oss-project·USaka livewire, laravel framework

reverbOn-prem

OSS Libraries / web-framework

Packagist

package-ecosystem

laravel/reverb

OSS Libraries

Exploitability

Official Patch Available

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Collection

View detailed technique mapping

References

https://github.com/laravel/reverb/security/advisories/GHSA-pfrr-xvrf-pxjx

github.com

https://github.com/laravel/reverb/pull/252

github.com

https://github.com/laravel/reverb/commit/73cc140d76e803b151fc2dd2e4eb3eb784a82ee2

github.com

and 3 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2024-50347 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows