Livewire: Remote Command Execution Through Unmarshalling

The talk covers a remote command execution issue in Livewire, a full-stack framework for Laravel that keeps front-end and back-end component state in sync through a JSON update endpoint. The presenters explain how Livewire serializes component data with its synthesizers, and how the collection synthesizer can be abused to instantiate arbitrary PHP classes when an attacker controls the metadata. Each request carries a checksum derived from the Laravel application key, so the attack depends on that key being known.

The middle section introduces PHP magic methods and how they are used to select unmarshalling gadgets. The researchers chained several gadgets, some already patched against classic unserialization, to reach arbitrary function calls and then remote command execution. They added a final gadget that ends the request early so the activity avoids normal error logging. A helper tool that computes valid checksums was demonstrated against Snipe-IT, an open-source asset management application that uses Livewire in its login flow.

The vendor did not treat the app-key requirement as a vulnerability, so the chain was left unpatched apart from advice to rotate keys. The presenters said they later found a route that needs no app key, which was patched quickly, and they plan to release their tooling later. The practical takeaway is to treat the application key as a high-value secret, to rotate it if exposure is suspected, and to keep framework components up to date.