Description
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
laradashboard laradashboard
Default version status: unaffected
0 to < 1.3.2affected1.3.2unaffected
pkg:github/laradashboard/laradashboardReferences
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-4x9p-vg5m-vr6p ↗
- https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Livewire/Marketplace/MarketplaceModuleBrowser.php#L76-L120 ↗
- https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Policies/ModulePolicy.php#L32-L38 ↗
- https://github.com/laradashboard/laradashboard/commit/738cc1a219ce459323ef1d09c3789075f1b8d2f2 ↗
- https://github.com/laradashboard/laradashboard/releases/tag/v1.3.2 ↗
- https://github.com/laradashboard/laradashboard ↗
- https://www.vulncheck.com/advisories/lara-dashboard-before-1.3.2-missing-authorization-in-marketplace-module-install-action ↗