CVE-2024-55661: Laravel Pulse RCE Vulnerability

CVE-2024-55661 Overview

Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. CVE-2024-55661 is a remote code execution vulnerability affecting Laravel Pulse versions prior to 1.3.1. The flaw resides in the public remember(callable $query, string $key = '') method within the Laravel\Pulse\Livewire\Concerns\RemembersQueries trait. Because the method is publicly accessible through Livewire components, an authenticated attacker with access to the Laravel Pulse dashboard can invoke arbitrary callables. This allows execution of any function or static method that requires no parameters or lacks strict parameter types. The vulnerability is classified as [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Authenticated users with Pulse dashboard access can invoke arbitrary PHP callables through Livewire, leading to remote code execution across all Pulse card components using the vulnerable trait.

Affected Products

Laravel Pulse versions prior to 1.3.1
All Pulse card components using the RemembersQueries trait
Laravel applications exposing the Pulse dashboard to authenticated users

Discovery Timeline

2024-12-13 - CVE-2024-55661 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55661

Vulnerability Analysis

The vulnerability stems from an overly permissive method visibility in the RemembersQueries trait. The remember() method was declared public, which exposed it as a callable action on any Livewire component that consumed the trait. Livewire routes browser-originated method invocations to public methods on server-side components. This exposure turned an internal caching helper into an attacker-controlled callable dispatcher. The method accepts a callable as its first argument and executes it inside a cache closure. When Livewire deserializes the incoming request payload, an attacker can substitute the $query argument with any PHP function name or static method reference that meets the parameter constraints.

Root Cause

The root cause is unrestricted callable invocation combined with public Livewire method exposure. The remember() method trusted its callable $query parameter without validating the origin or type of the callable. PHP's callable type accepts strings referencing global functions and array syntax referencing static methods. Any function or static method that has no parameters or no strict parameter types could be invoked, satisfying the invocation contract required by the cache closure.

Attack Vector

Exploitation requires an authenticated session with access to the Laravel Pulse dashboard. The attacker sends a crafted Livewire request targeting a Pulse card component. The request specifies remember as the action and provides an arbitrary callable, such as phpinfo or a class static method, as the $query argument. The server executes the callable in the application context, resulting in remote code execution with the privileges of the PHP process.

php

     *
     * @return array{0: mixed, 1: float, 2: string}
     */
-    public function remember(callable $query, string $key = '', DateTimeInterface|DateInterval|Closure|int|null $ttl = 5): array
+    protected function remember(callable $query, string $key = '', DateTimeInterface|DateInterval|Closure|int|null $ttl = 5): array
    {
        return App::make(CacheStoreResolver::class)->store()->remember('laravel:pulse:'.static::class.':'.$key.':'.$this->period, $ttl, function () use ($query) {
            $start = CarbonImmutable::now('UTC')->toDateTimeString();

Source: Laravel Pulse Security Patch Commit d1a5bf2

The patch changes method visibility from public to protected, preventing Livewire from routing external requests to the method while preserving internal usage within Pulse components.

Detection Methods for CVE-2024-55661

Indicators of Compromise

Livewire request payloads targeting Pulse card components with a remember method call and unexpected callable arguments such as phpinfo, system, exec, or shell_exec.
Unexpected PHP-FPM or web server child processes spawned by the application user immediately following authenticated requests to /pulse.
Cache entries prefixed with laravel:pulse: containing values inconsistent with normal Pulse aggregations.

Detection Strategies

Inspect application and web server logs for POST requests to the Livewire message endpoint referencing Pulse component class names combined with the remember action.
Enable Laravel query and command logging to correlate anomalous callable invocations with authenticated Pulse dashboard sessions.
Review authentication logs for accounts with Pulse dashboard access performing atypical navigation patterns or repeated component interactions.

Monitoring Recommendations

Alert on any child process creation by the PHP runtime that is not part of the application's known execution baseline.
Monitor outbound network connections from application servers hosting Laravel Pulse, particularly to unfamiliar destinations.
Track modifications to files under the application root and to writable storage paths outside of expected deployment activity.

How to Mitigate CVE-2024-55661

Immediate Actions Required

Upgrade Laravel Pulse to version 1.3.1 or later, which restricts the remember() method to protected visibility.
Audit the Pulse Gate::define('viewPulse', ...) authorization callback and restrict dashboard access to a minimal set of trusted operators.
Rotate application secrets, API tokens, and database credentials if exploitation is suspected, since RCE grants access to the .env file.

Patch Information

The fix is available in Laravel Pulse 1.3.1. The patch commit changes the remember() method visibility from public to protected in src/Livewire/Concerns/RemembersQueries.php. See the GitHub Security Advisory GHSA-8vwh-pr89-4mw2 and the patch commit d1a5bf2 for full details.

Workarounds

Restrict access to the Pulse dashboard through the PulseServiceProvider gate so only administrators with an operational need can authenticate.
Place the Pulse route behind network-level controls such as VPN, IP allowlisting, or a reverse proxy requiring additional authentication.
Temporarily disable Pulse by removing its route registration or unpublishing the dashboard until the upgrade to 1.3.1 is deployed.

bash

# Upgrade Laravel Pulse to the patched release
composer require laravel/pulse:^1.3.1
composer update laravel/pulse
php artisan config:clear
php artisan route:clear
php artisan view:clear