LiveWire: Remote Command Execution Through Unmarshalling
summary
Livewire’s JSON synthesizers allow instantiation of arbitrary PHP classes via the CLCTN type, and by controlling the meta/class and value fields an attacker can chain gadgets (fn_stream for __toString or __destruct, a prefix string caster, then a dispatcher into Laravel’s queue/serialization) to get remote command execution; exploitation requires requires APP_KEY to reforge Livewire checksums, works against many Livewire apps (≈700k installs), and laravel-crypto-killer automates payload generation. CVE-2025-54068 later covers an RCE variant that removes the APP_KEY prerequisite.
AI-written summary · about
chapters (11)
- 0:00Introduction and presenters
- 1:06What is LiveWire in Laravel
- 4:21LiveWire’s synthesizer mechanism
- 7:55Prerequisites for exploitation
- 9:19PHP magic methods and gadgets
- 12:50Unmarshalling chain discovery
- 18:31Achieving remote command execution
- 21:20Automating the exploit with Laravel Cryptokiller
- 24:12Live demonstration on Snipe-IT
- 27:03Research findings and conclusions
- 30:37Q&A session
related talks
43mLivewire 3
29mBuilding Mobile Apps with PHP
22mTh1nk Lik3 a H4cker
31mHow your Laravel application can get hacked, and how to prevent that from happening
36mReal-Time Laravel
27mPhilo Hermans :: Reusing Reusable Livewire Components
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk