Livewire remote command execution through unmarshaling

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.synacktiv.com/en/publications/livewire-remote-command-execution-through-unmarshaling.html
• Blog Title: Livewire: remote command execution through unmarshaling
• Suggested Section: Pentesting Web -> Deserialization -> Livewire Hydration Synthesizer Abuse (update existing Livewire entry / add subsection for Livewire v3 synthetic tuples + CVE-2025-54068)

🎯 Content Summary

Title: Livewire: remote command execution through unmarshaling (Synacktiv, 2025-12-23).

Executive technical overview
The post dissects Livewire v3’s hydration/dehydration mechanism and shows two RCE paths:
1) Design flaw / attack surface: if an attacker knows the Laravel APP_KEY, they can forge Livewire snapshot checksums and inject synthetic tuples to force arbitrary PHP object instantiation during hydration, then chain gad...

🔧 Technical Details

Trick 1 — Turn Livewire “synthetic tuples” into an object-instantiation primitive.
Any payload shaped like [value, meta] where meta contains {"s": "KEY"} is treated as a synthesizer tuple. Livewire chooses a synth from meta['s'] and calls its hydrate(), often instantiating objects. If an attacker can influence meta (directly, or indirectly via a bug), synths like CollectionSynth (clctn) can instantiate arbitrary classes using new $meta['class']($value) after recursively hydrating children, providing a powerful construction primitive for PHP gadget chains.

Trick 2 — Execute code by forcing a typed string cast that triggers __toString().
Instantiate GuzzleHttp\Psr7\FnStream (array constructor) with {"__toString":"<function>"} so FnStream::__toString() calls the chosen function. Then pa...

🤖 Agent Actions

I’m mapping the existing Laravel and deserialization pages first, then I’ll compare several candidate files to avoid putting Livewire details in the wrong section.
There is already a dedicated Livewire page under web deserialization, so I’m checking whether the new Synacktiv material is already covered there or if it needs a compact extension.
The dedicated page already contains most of the Synacktiv chain, so I’m now looking for concrete gaps instead of duplicating the same technique under Laravel or generic PHP deserialization.
I’ve narrowed it to one existing page. I’m patching only the Livewire deserialization entry to add the missing exploitation shortcut and patch-analysis details, not duplicating them elsewhere.
The edit is in place. I’m reading the updated page and diff now to make sure the additions stay concise, technically accurate, and limited to this single file.
Updated livewire-hydration-synthesizer-abuse.md.

The page already covered most of the Synacktiv research, so I kept the change scoped to that single existing file and only added the missing technical value from the blog: the Filament pre-auth form shortcut, the hydratePropertyUpdate() patch-analysis detail, the ?v=HASH fingerprinting variant, corrected the affected-version wording, and fixed the Synacktiv reference URL while adding the patch commit reference.

Verified with git diff and a reread of the edited section; no duplicate content was added to other Laravel/PHP pages.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.synacktiv.com/en/publications/livewire-remote-command-execution-through-unmarshaling.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Deserialization -> Livewire Hydration Synthesizer Abuse (update existing Livewire entry / add subsection for Livewire v3 synthetic tuples + CVE-2025-54068)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0