Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency livewire/livewire to v2.12.7 [security] #181

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency livewire/livewire to v2.12.7 [security] #181

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 9, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
livewire/livewire 2.10.7 -> 2.12.7 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-47823

In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.php” file extension.
If the following criteria are met, the attacker can carry out an RCE attack:

  • Filename is composed of the original file name using $file->getClientOriginalName()
  • Files stored directly on your server in a public storage disk
  • Webserver is configured to execute “.php” files

PoC

In the following scenario, an attacker could upload a file called shell.php with an image/png MIME type and execute it on the remote server.

class SomeComponent extends Component
{
    use WithFileUploads;

    #[Validate('image|extensions:png')]
    public $file;

    public function save()
    {
        $this->validate();

        $this->file->storeAs(
            path: 'images',
            name: $this->file->getClientOriginalName(),
            options: ['disk' => 'public'],
        );
    }
}

Release Notes

livewire/livewire (livewire/livewire)

v2.12.7

Compare Source

What's Changed

New Contributors

Full Changelog: livewire/livewire@v2.12.6...v2.12.7

v2.12.6

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.12.5...v2.12.6

v2.12.5

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.12.4...v2.12.5

v2.12.4

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.12.3...v2.12.4

v2.12.3

Compare Source

  • Added missing component resolver to resolve expensive components JIT

Full Changelog: livewire/livewire@v2.12.2...v2.12.3

v2.12.2

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.12.1...v2.12.2

v2.12.1

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.12.0...v2.12.1

v2.12.0

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.11.3...v2.12.0

v2.11.3

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.11.2...v2.11.3

v2.11.2

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.11.1...v2.11.2

v2.11.1

Compare Source

What's Changed

New Contributors

Full Changelog: livewire/livewire@v2.11.0...v2.11.1

v2.11.0

Compare Source

What's Changed

Full Changelog: livewire/livewire@v2.10.8...v2.11.0

v2.10.8

Compare Source

What's Changed

New Contributors

Full Changelog: livewire/livewire@v2.10.7...v2.10.8

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Oct 9, 2024 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Command failed: composer update livewire/livewire:2.12.7 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
The temporary constraint "2.12.7" for "livewire/livewire" must be a subset of the constraint in your composer.json (^3.0)

@renovate renovate bot changed the title fix(deps): update dependency livewire/livewire to v3 [security] fix(deps): update dependency livewire/livewire to v2.12.7 [security] Oct 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants