CVE-2024-50347
published 2024-10-31CVE-2024-50347: Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures…
PriorityP336medium6.3CVSS 4.0
AVNACHATPPRNUINVCLVILVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUGreen
EPSS
0.33%
25.0th percentile
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| laravel | reverb | < 1.4.0 | 1.4.0 |
| laravel | reverb | >= 0 < 1.4.0 | 1.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Laravel Reverb Missing API Signature Verification
osv·2024-10-31
CVE-2024-50347 [HIGH] Laravel Reverb Missing API Signature Verification
Laravel Reverb Missing API Signature Verification
### Impact
A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.
The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.
> [!NOTE]
> This issue only affects the Push
GHSA
Laravel Reverb Missing API Signature Verification
ghsa·2024-10-31
CVE-2024-50347 [HIGH] CWE-345 Laravel Reverb Missing API Signature Verification
Laravel Reverb Missing API Signature Verification
### Impact
A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.
The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.
> [!NOTE]
> This issue only affects the Push
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-31
Published