Back
kikedop

Kike

@kikedop

My dear Livewire believers, I need your help. Yesterday, one of my projects was attacked by what I believe were automated bots.

The issue is that the scripts were targeting (among other things) the "livewire/update" route. They were attempting to call methods that clearly don't exist or trying to access properties.

I suspect they might have bypassed the checksum check, but I'm not sure.

Has anyone seen anything like this before?

image
image

3 • •

192

•
  • No matching results...
  • Searching...

/ 1000

danielpetrica

Andrei Daniel Petrica

@danielpetrica

if you're behind something like cloudflare can you activate the antibot feature so you temporary block them?

1 • •

92

•
kikedop

Kike

@kikedop

Thank you Andrei. Yes it can be made with cloudflare. But what I do is that I go deep into nginx access log, copy the offending IPs and block them via firewall and also a silly global middleware that checks IPs and if in my list, they get redirected anywhere else.

I also checked in an IP address lookup service and all offending IPs are from datacenters in Belgium, Germany, Finland, SFO... so definitely automated and as far as I'm concerned, blocked forever 😂

• •

82

•
brimmar

Bryan Martin

@brimmar

Never heard of it, maybe they found some vulnerabilities on livewire apps? But i don't know what could it be

1 • •

102

•
kikedop

Kike

@kikedop

😔 yup. It is indeed very strange.

• •

36

•
MrPunyapal

Punyapal Shah ☁️🦹

Verified

@MrPunyapal

Btw it is totally possible

Even I can copy component id from snapshot and call any method or property I want with using.

Livewire.find('componentId').call('method', { parameters });


Always Authorize and use #[Locked] where needed.

Don't trust on user like me 😅

1 • •

163

•
kikedop

Kike

@kikedop

Thank you Punyapal. The thing is… can you target livewire/update being a post route overriding cors middleware and livewire’s internal checksum check?

I mean they were using a Guzzle client targeting the route directly.

If so, then the route should be auth protected meaning you couldn’t use livewire component in a public page.

Also that using livewire is a big liability.

1 • •

127

•
MrPunyapal

Punyapal Shah ☁️🦹

Verified

@MrPunyapal

That doesn't seem posible (bypassing checksum).

Brw you can use Livewire component anywhere just be careful of sensitive data. And use it wise as much as possible 🙌

• •

111

•