Unrestricted Deserialization in Laravel Reverb Enables Remote Code Execution

Executive Summary

This vulnerability exists in Laravel Reverb versions 1.6.3 and below, where data from the Redis channel is passed directly into PHP's unserialize() function without restricting which classes can be instantiated. This allows an attacker to perform Remote Code Execution (RCE) by exploiting the unserialize process. The risk is higher because Redis servers are often deployed without authentication, but the vulnerability only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to Remote Code Execution on the server running Laravel Reverb, allowing an attacker to execute arbitrary code remotely. This can compromise the confidentiality, integrity, and availability of the affected system and potentially the entire application environment.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your Laravel Reverb version is 1.6.3 or below and if the environment variable REVERB_SCALING_ENABLED is set to true. Additionally, verify if your Redis server is accessible without authentication. Commands to check the Laravel Reverb version and environment variables depend on your deployment but generally include inspecting your application's composer.lock or package files and environment configuration files. To check Redis accessibility, you can use: `redis-cli ping` to see if Redis responds without authentication, and `redis-cli config get requirepass` to check if a password is set.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Laravel Reverb to version 1.7.0 or later, requiring a strong password for Redis access, ensuring Redis is only accessible via a private network or local loopback, and/or setting the environment variable REVERB_SCALING_ENABLED=false to bypass the vulnerable logic if only one Reverb node is used.

Useful 0 Not Useful 0