Laravel Livewire Code Injection (CVE-2025-54068)

union DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents
| where TimeGenerated > ago(24h)
| where (ActionType in ("HttpRequestReceived", "NetworkConnectionFound") and (RemoteUrl contains "/livewire/message" or RemoteUrl contains "/livewire/upload-file")) or (FileName endswith ".php" and FolderPath contains "livewire" and InitiatingProcessCommandLine contains "eval(")
| extend SuspiciousPayload = extract(@"(eval\(|base64_decode\(|system\(|exec\(|shell_exec\(|passthru\()", 0, tostring(AdditionalFields))
| where isnotempty(SuspiciousPayload) or (ActionType == "HttpRequestReceived" and toint(ResponseCode) between (200 .. 299) and (RequestBody contains "eval(" or RequestBody contains "base64_decode(" or RequestBody contains "__construct" or RequestBody contains "$this->" and RequestBody contains "system("))
| project TimeGenerated, DeviceName, ActionType, RemoteUrl, RemoteIP, InitiatingProcessAccountName, SuspiciousPayload, AdditionalFields
| order by TimeGenerated desc

index=web OR index=app sourcetype IN ("access_combined", "php_error", "laravel", "nginx_access", "apache_access")
| where (uri_path="*/livewire/message*" OR uri_path="*/livewire/upload-file*")
| eval request_body=coalesce(request_body, _raw)
| eval suspicious_functions=if(match(request_body, "(eval\(|base64_decode\(|system\(|exec\(|shell_exec\(|passthru\(|proc_open\(|popen\()"), 1, 0)
| eval php_injection=if(match(request_body, "(\\$_GET|\\$_POST|\\$_REQUEST|\\$_SERVER|__class__|__construct)") AND match(request_body, "(eval|assert|create_function)"), 1, 0)
| where suspicious_functions=1 OR php_injection=1
| eval status_code=coalesce(status, sc_status)
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(uri_path) as endpoints by host, status_code
| where count > 0
| sort -last_seen

sequence by host.name with maxspan=5m
  [network where event.category == "network" and
   (url.path : "*/livewire/message*" or url.path : "*/livewire/upload-file*") and
   http.request.method == "POST"]
  [process where event.category == "process" and event.type == "start" and
   (process.name in ("php", "php-fpm", "php8.0", "php8.1", "php8.2", "php8.3") or
    process.parent.name in ("php", "php-fpm", "nginx", "apache2", "httpd")) and
   (process.args : ("*eval(*", "*system(*", "*exec(*", "*shell_exec(*", "*base64_decode(*")) or
   (process.name in ("bash", "sh", "dash", "curl", "wget") and
    process.parent.name in ("php", "php-fpm"))]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as event_time,
  sourceip, destinationip, destinationport,
  URL, username, QIDNAME(qid) as event_name,
  magnitude, "domainid"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'PHP Logs', 'Laravel')
  AND (URL ILIKE '%/livewire/message%' OR URL ILIKE '%/livewire/upload-file%')
  AND (
    PAYLOAD ILIKE '%eval(%'
    OR PAYLOAD ILIKE '%base64_decode(%'
    OR PAYLOAD ILIKE '%system(%'
    OR PAYLOAD ILIKE '%exec(%'
    OR PAYLOAD ILIKE '%shell_exec(%'
    OR PAYLOAD ILIKE '%passthru(%'
    OR PAYLOAD ILIKE '%proc_open(%'
  )
  AND starttime > NOW() - 86400000
ORDER BY devicetime DESC
LIMIT 500

_sourceCategory=web/access OR _sourceCategory=php/error OR _sourceCategory=laravel/app
| where uri_path matches "*livewire/message*" or uri_path matches "*livewire/upload-file*"
| parse regex field=_raw "(?P<payload>\{.+\})" nodrop
| where payload matches "*eval(*" or payload matches "*base64_decode(*" or payload matches "*system(*" or payload matches "*exec(*" or payload matches "*shell_exec(*"
| timeslice 5m
| count by _timeslice, src_ip, uri_path, status_code
| where _count > 0
| sort by _timeslice desc

rule cve_2025_54068_livewire_code_injection {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-54068 Laravel Livewire code injection exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.url.path = /.*livewire\/(message|upload-file).*/
    $http.network.http.method = "POST"
    (
      $http.network.http.request_body = /eval\(/ or
      $http.network.http.request_body = /base64_decode\(/ or
      $http.network.http.request_body = /system\(/ or
      $http.network.http.request_body = /shell_exec\(/ or
      $http.network.http.request_body = /passthru\(/
    )
  condition:
    $http
}

event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "DnsRequest") AND
(
  (
    event_simpleName = "NetworkConnectIP4" AND
    (HttpPath = "*/livewire/message*" OR HttpPath = "*/livewire/upload-file*") AND
    HttpMethod = "POST"
  ) OR
  (
    event_simpleName = "ProcessRollup2" AND
    ParentBaseFileName IN ("php", "php-fpm", "php8.0", "php8.1", "php8.2", "php8.3") AND
    FileName IN ("bash", "sh", "curl", "wget", "python", "python3", "perl") AND
    CommandLine != ""
  )
)
| eval risk=if(match(CommandLine, "(eval|system|exec|shell_exec|base64_decode|passthru)"), "HIGH", "MEDIUM")
| where risk = "HIGH"
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, HttpPath, RemoteAddressIP4
| sort -_time