CVE-2024-47823·PHP vulnerability
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack: 1. Filename is composed of the original file name using `$file->getClientOriginalName()`. 2. Files stored directly on your server in a public storage disk. 3. Webserver is configured to execute “.php” files. This issue has been addressed in release versions `2.12.7` and `3.5.2`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Severity
- critical
- Software
- PHP
- Fixed in
- 3.5.2
- Published
- 2024-10-08
Affected versions
From: 3.0.0
Until: 3.5.2
Fixed in: 3.5.2
How to fix this CVE
Upgrade PHP and Livewire to patch a critical file upload validation bypass that allows remote code execution. Update to Livewire version 3.5.2 or later, and ensure PHP is updated to the latest stable release. Review your file storage configuration to ensure uploaded files are not stored in web-accessible directories, and verify that your web server is not configured to execute PHP files outside of designated directories.
sudo dnf update phpDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST request to file upload endpoint with Content-Type header containing valid image MIME type (e.g., image/png) but filename containing .php extension (e.g., shell.php.png or shell.png.php); followed by HTTP GET request to the stored file location attempting to execute the uploaded PHP fileWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement WAF rules to block file uploads where the file extension does not match the declared Content-Type MIME type. Example: Block any request where Content-Type: image/* but filename contains .php, .phtml, .phar, .phps, .php3, .php4, .php5, .php7, .shtml, or other executable extensions. Additionally, reject uploads with double extensions or null-byte injection attempts.How to check if you are affected
- Check installed PHP version: php -v
- Verify Livewire version in your Laravel project: grep -i 'livewire' composer.lock | head -20
- Search web server logs for suspicious file uploads with .php extensions: grep -i '\.php' /var/log/apache2/access.log | grep -i 'upload\|file'
- Verify the fix by checking if Livewire validates file extensions independently of MIME types: php artisan livewire:list (if available) or inspect vendor/livewire/livewire/src/Mechanisms/HandleUploads.php for extension validation logic
Indicators of compromise
- HTTP POST requests to Laravel routes handling file uploads with mismatched MIME type and executable extension
- Presence of .php files in public storage directories (storage/app/public or similar web-accessible upload paths)
- Web server access logs showing requests for recently uploaded files with .php extensions being served with 200 status code
- POST multipart form-data requests where Content-Type header claims an image type but uploaded filename ends in .php
FAQ
What is CVE-2024-47823?
CVE-2024-47823 is a critical remote code execution vulnerability in Livewire that occurs when the framework guesses file extensions based solely on MIME type without validating the actual file extension. An attacker can upload a malicious PHP file disguised with an image MIME type, which then gets executed if stored in a publicly accessible directory.
Is CVE-2024-47823 being actively exploited?
According to CISA's Known Exploited Vulnerabilities catalog, CVE-2024-47823 is not currently listed as actively exploited in the wild. However, the attack is straightforward to execute and should be patched immediately.
What versions of PHP are affected by CVE-2024-47823?
While CVE-2024-47823 is a Livewire vulnerability, it affects applications using Livewire versions 3.0.0 through 3.5.1 on any PHP version. The earlier series (2.x) is also affected up to version 2.12.6. PHP itself is not vulnerable, but the framework component running on PHP is.
How do I check if my server is vulnerable to CVE-2024-47823?
Run composer show livewire/livewire in your Laravel project root to view the installed Livewire version. If it shows a version lower than 3.5.2 or 2.12.7, your server is vulnerable. Additionally, verify that your storage/app/public directory (or custom public storage disk) is served directly by the web server and that PHP execution is enabled there.
Does Defensia detect CVE-2024-47823?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Livewire is installed on a monitored server, CVE-2024-47823 will appear in your dashboard with remediation steps and version mismatch alerts.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-47823. Free for 1 server.
Get started free