GHSA-mhf7-xp6r-6qrc: Medium severity composer/livewire/livewire vulnerability
Impact
Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for:
1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('delete', 'comment')] on deleteComment(Comment $comment), a user could delete another user's comment. 2. The same issue on event listeners. Methods using both #[On] and #[Authorize] with a model parameter were affected in the same way through the dispatch call. 3. #[Json] methods ran before authorization. When a method had both #[Json] and #[Authorize], the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.
Only applications using the #[Authorize] attribute are affected: on methods that take model parameters (issues 1 and 2), or on #[Json] methods (issue 3). Authorization performed inside the method (e.g. $this->authorize(...)) is not affected. Livewire 3.x is not affected.
Patches
Fixed in v4.4.8. Call and event parameters must now be a list or use named (string) keys, otherwise the request is rejected, and #[Json] methods are authorized before they run.
Workarounds
Upgrade to v4.4.8. If you can't upgrade right away, call $this->authorize(...) inside affected methods instead of relying on the #[Authorize] attribute.
Credits
Reported by Yousef Aman (@yousef-aman).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/livewire/livewireto a version that resolves this vulnerability.Fixed in 4.4.8 - Upgrade
Upgrade
Livewireto a version that resolves this vulnerability.Fixed in 4.4.8 - Compensating control
If you cannot upgrade immediately, call $this->authorize(...) inside affected methods instead of relying on the #[Authorize] attribute.
Event History
Frequently Asked Questions
Which applications are affected?
Only applications that use Livewire's #[Authorize] attribute are affected. The parameter-ordering issues require authorized methods or #[On] event listeners that take model parameters, while the authorization-ordering issue requires methods that use both #[Json] and #[Authorize].
What does an attacker need to exploit the parameter-ordering issues?
The attacker needs low-privileged access sufficient to invoke the affected action or dispatch the affected event. They can submit parameters as an object with reordered integer keys so authorization is evaluated against a record they may access while the method receives a different record.
What is the impact of combining #[Json] and #[Authorize]?
The method body can execute before authorization is checked. Although the response is still a 403, side effects such as database writes may already have occurred.
What should be prioritized if patching cannot happen immediately?
Review uses of #[Authorize] on methods and #[On] listeners that accept model parameters, and uses of #[Json] together with #[Authorize]. Restrict or disable exposed actions that can modify or delete records until they can be remediated.