CVE-2025-54068 Exploit Metadata

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Python script that performs a two-stage remote code execution attack against a Livewire 3.6.3 application by sending crafted JSON payloads to the Livewire update endpoint, using a PHP deserialization chain to execute a system command and confirming success via an in-band marker.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a legitimate exploit for CVE-2025-54068 against a vulnerable Livewire instance. It uses a safe in-band marker (echo) as proof of RCE and contains no concealed backdoor, credential theft, persistence, or unrelated payload.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareLivewireLaravel

Attack typesRemote Code ExecutionDeserialization of Untrusted Data

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted payloads to execute a system command on the target server and verifies the output, which constitutes exploitation rather than mere detection or scanning.

scripts/poc.py:105scripts/poc.py:178-179

Requirements

A Livewire component must be mounted and configured to allow property updates that can be cast to an array.README.md:5
The target must be running Livewire v3 up to 3.6.3.README.md:3

Observed behavior

Fetches the target page and extracts CSRF token, update URI, and wire:snapshot.scripts/poc.py:57-75
Sends a first JSON payload to cast a component property to an array, obtaining a new signed snapshot.scripts/poc.py:88-101
Sends a second JSON payload containing a PHP deserialization gadget chain that executes 'echo LAB_CVE_2025_54068_OK' via the system function.scripts/poc.py:103-177
Checks the response for the marker string to confirm successful command execution.scripts/poc.py:178-183

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution: echo LAB_CVE_2025_54068_OKThe PoC executes a safe echo command as an in-band proof of RCE, consistent with the stated CVE exploit.scripts/poc.py:105
Exploit Chain: PHP deserialization gadget chain targeting Livewire component updatesThe PoC constructs a two-stage exploit using a known deserialization chain to achieve RCE, matching the CVE description.scripts/poc.py:88-175

Review boundaries

What the analysis did not establish

Only 3 of 10 repository files were provided as readable text; the remaining 7 files (including PHP component and view files) were omitted, limiting full context of the vulnerable component setup.
The evidence does not include the execution output of the script, so the exploit's success is based solely on the code logic.
7 text files and 0 binary files were omitted from the evidence packet; their content was not reviewed.
The review is based solely on the supplied text evidence and does not verify the safety of the target application or the exploit's reliability.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

docker-compose.yml

Created 2026-01-08Vuln labCVE-2025-54068Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker Compose environment that builds a Laravel 11.0.0 application with Livewire 3.6.3, serving a minimal counter page on port 18081. The README and PoC script explicitly state it is a vulnerable lab for CVE-2025-54068.

README.md:1-3docker-compose.yml:1-17

Lab assessment

Vulnerability lab

The README titles the repository 'CVE-2025-54068 - Livewire (v3.6.3) Vulnerable Lab', describes it as a minimal application for reproducing CVE-2025-54068, and provides a PoC script that attempts to demonstrate RCE via a two-stage request sequence. The Dockerfile pins vulnerable Livewire 3.6.3 and the Counter component is intentionally untyped to allow the exploit chain.

README.md:1-3README.md:5README.md:15-17app/Livewire/Counter.php:9-10

Lab shapeCompose · builds

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

laravel

vulnerable target applicationweb server

A single service built from the Dockerfile, running Apache with PHP 8.3.29. It hosts a Laravel 11.0.0 application with Livewire 3.6.3, exposes port 80 mapped to host port 18081, and uses SQLite for storage. The application serves a counter page that mounts a Livewire component intentionally vulnerable to CVE-2025-54068.

docker-compose.yml:3-12Dockerfile:1-58resources/views/counter.blade.php:1-19

poc.py

exploit proof-of-concept script

A Python script that performs a two-stage HTTP request sequence against the target to demonstrate RCE for CVE-2025-54068. It extracts CSRF token and Livewire snapshot from the page, sends a stage-1 request to cast a property to array, then sends a stage-2 request with a crafted deserialization chain that executes 'echo LAB_CVE_2025_54068_OK' and checks for the marker in the response.

scripts/poc.py:1-188README.md:15-17

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-54068

Supported by supplied evidence

The entire lab is explicitly built to reproduce CVE-2025-54068. The README states it is a vulnerable lab for this CVE, the Dockerfile pins the vulnerable Livewire version 3.6.3, the Counter component is intentionally untyped to allow the exploit, and the PoC script attempts to achieve RCE using a deserialization chain consistent with public exploit descriptions.

README.md:1-3Dockerfile:3app/Livewire/Counter.php:9-10scripts/poc.py:1-188

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose installed on the host to build and run the environment.README.md:9-11
Python 3 available on the host to execute the PoC script.README.md:17
Network access to the target application on host port 18081.docker-compose.yml:9-10

Evidence-described exercise path

Build and start the vulnerable environment with 'docker compose up -d --build'.README.md:9-11
Open the target application at http://localhost:18081/ to verify it is running.README.md:13
Run the PoC script: 'python3 scripts/poc.py http://localhost:18081/'. The script extracts CSRF token and snapshot, sends a stage-1 request to cast a property to array, then sends a stage-2 request with a crafted deserialization chain that executes 'echo LAB_CVE_2025_54068_OK' and checks for the marker in the response.README.md:15-17scripts/poc.py:1-188
Observe the output: if the marker 'LAB_CVE_2025_54068_OK' appears, RCE is confirmed.scripts/poc.py:175-178
Clean up with 'docker compose down -v'.README.md:21-23

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The PoC script targets only the lab's own containerized application via HTTP on the mapped port. It executes a harmless 'echo' command as an in-band proof of RCE and does not attempt to escape the container, access the host filesystem, connect to external systems, or perform any destructive actions. The Docker Compose configuration does not use privileged mode, host volume mounts, or other settings that would grant host access. All behavior is consistent with a self-contained vulnerability lab.

scripts/poc.py:100-101scripts/poc.py:175-178docker-compose.yml:1-17

Review boundaries

What the analysis did not establish

The PoC script uses a complex deserialization chain that could be adapted for malicious purposes if the marker command were replaced, but the supplied script itself is benign.
The Dockerfile downloads composer from a remote URL during build, which is a common practice but introduces a supply chain dependency not inspected here.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2025-54068