CVE-2024-50347— Laravel Reverb has Missing API Signature Verification
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-50347
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Laravel Reverb has Missing API Signature Verification
Source: NVD (National Vulnerability Database)
Vulnerability Description
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
密码学签名的验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Laravel Reverb 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Laravel Reverb是The Laravel Framework开源的一个库。为Laravel应用程序带来了实时WebSocket通信。 Laravel Reverb 1.4.0之前版本存在数据伪造问题漏洞，该漏洞源于对发送到Reverb的Pusher兼容API的请求的验证签名未进行验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50347
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50347
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: laravel
- CVE-2026-39976
Laravel Passport's TokenGuard Authenticates Unrelated User f - CVE-2026-23524
Laravel Redis Horizontal Scaling Insecure Deserialization - CVE-2021-47756
Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) - CVE-2025-27515
Laravel has a File Validation Bypass - CVE-2024-55661
Laravel Pulse Allows Remote Code Execution via Unprotected Q
Same weakness: CWE-347
- CVE-2026-42193
Plunk: SNS webhook forgery - CVE-2026-44497
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type - CVE-2026-41669
Admidio: SAML Signature Validation Result Ignored — Forged A - CVE-2026-7689
Dolibarr ERP CRM Online Signature security.lib.php dol_verif - CVE-2026-33467
Improper Verification of Cryptographic Signature in Elastic
V. Comments for CVE-2024-50347
No comments yet