CVE-2024-47823

Summary

CVE-2024-47823 is a vulnerability affecting Livewire, a full-stack framework for Laravel. In versions prior to 2.12.7 and 3.5.2, Livewire incorrectly determines file extensions based on MIME types. This allows attackers to bypass validation by uploading files with valid MIME types and " .php" extensions. If specific conditions are met - the filename uses $file->getClientOriginalName(), files are stored directly on the server in a public storage disk, and the webserver executes " .php" files - an attacker can execute arbitrary code (RCE). Users are recommended to upgrade to versions 2.12.7 and 3.5.2 to mitigate this risk. There are currently no known workarounds for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.