EUVD-2026-74847
GHSA-w83g-wg62-w3qm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as content editor
-
DeliveryPOST /api/admin/builder/markdown/fetch with internal/IMDS URL
-
ExploitServer issues unvalidated outbound HTTP request
-
ExecutionRead IAM role name from IMDS response
-
PersistFetch role credential endpoint via second SSRF request
-
ImpactExfiltrate temporary AWS IAM credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must possess a valid Lara Dashboard session with at least one of the following permissions: post.create, post.edit, email_template.create, or email_template.edit - standard content-editing roles assigned to regular editorial staff, not restricted to administrators. The markdown fetch endpoint is active by default as part of the builder UI; no non-default feature toggle is required. For the highest-impact scenario (IAM credential theft), the server must be running on a cloud VM with an attached IAM role and IMDSv1 enabled (the default on AWS EC2 unless IMDSv2-only is explicitly enforced). Internal service enumeration via SSRF is possible in any deployment where the server has network reachability to private-range hosts. Egress filtering that blocks outbound requests to 169.254.0.0/16 and RFC 1918 ranges limits exploitation to only externally reachable destinations. |
| Impact | The CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) is well-calibrated. PR:L correctly reflects that exploitation requires an active authenticated session with at least one content-editing permission; this limits the attack surface compared to unauthenticated SSRF but is not a strong barrier since editorial accounts are commonly distributed. The C:H rating is accurate for cloud-deployed instances where AWS/GCP/Azure IMDS endpoints are reachable by default - IMDSv1 requires no session token and yields temporary IAM credentials in a single request, which can lead to full cloud account compromise depending on the attached role. I:L accounts for potential unintended write-side-effects on internal services that accept POST semantics. EPSS data was not supplied; KEV status is not confirmed. The real-world priority is elevated specifically for cloud-hosted deployments and reduced for on-premises instances with strict egress filtering. IMDSv2 enforcement (requiring a PUT session before metadata GET) partially mitigates the credential-theft scenario but does not prevent internal service enumeration. |
| Exploit ScenarioDerived | An authenticated Lara Dashboard user holding the post.edit permission sends POST /api/admin/builder/markdown/fetch with url=http://169.254.169.254/latest/meta-data/iam/security-credentials/, receiving back the list of attached IAM role names from the server's IMDS response. A second request targeting the role-specific endpoint returns a JSON payload containing AccessKeyId, SecretAccessKey, and Token, granting the attacker cloud API access scoped to that IAM role. The entire attack requires only two authenticated HTTP requests with no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTTP requests through the application server via the markdown fetch API endpoint, with the server returning response bodies verbatim to the caller. The POST /api/admin/builder/markdown/fetch endpoint validated only URL format (not destination host), enabling requests to internal services and cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, which can yield IAM role temporary credentials. No public exploit identified at time of analysis; vendor-released patch is available in v1.3.2.
RemediationAI
Upgrade Lara Dashboard to version 1.3.2, available at https://github.com/laradashboard/laradashboard/releases/tag/v1.3.2, which introduces SafeUrlValidator and dedicated form request classes that enforce destination-host validation. The fix commit is https://github.com/laradashboard/laradashboard/commit/738cc1a219ce459323ef1d09c3789075f1b8d2f2. If immediate upgrade is not feasible, block the POST /api/admin/builder/markdown/fetch route at the WAF or reverse-proxy layer, accepting that the markdown URL-fetch editor feature will be disabled for users. As a cloud-specific compensating control, enforce IMDSv2 on all EC2 or equivalent instances (requiring a session-oriented PUT token before metadata GET requests); this prevents IMDSv1 credential theft via SSRF while leaving the application endpoint reachable. Implement egress filtering to deny outbound HTTP from the application server to RFC 1918 and link-local ranges; this limits internal pivoting but requires network-layer changes and may affect legitimate integrations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in app/Services/Builder/MarkdownFetchService.php, invoked by app/Http/Controllers/Api/Builder/MarkdownController.php. Pre-fix, the fetch action used Laravel's built-in url validation rule, which verifies URL format but does not block private, loopback, or link-local address ranges (RFC 1918, 127.0.0.0/8, 169.254.0.0/16). The server then issued an outbound HTTP request to the caller-supplied URL and returned the response. CWE-918 (Server-Side Request Forgery) precisely describes this class of flaw. The commit diff confirms the fix introduced a dedicated MarkdownFetchRequest form request class and a new app/Support/Security/SafeUrlValidator.php helper, replacing raw format-only validation with host-level allowlist/blocklist enforcement. The affected CPE is cpe:2.3:a:laradashboard:laradashboard:*:*:*:*:*:*:*:*.
Know when Laradashboard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
PR:L reflects mandatory authenticated content-editor session; C:H captures IMDS credential exposure; I:L covers potential unintended write side-effects on reachable internal services.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IAM credentials by supplying malicious URLs without host validation or redirect restrictions.
Technical POC Analysis
CWE-918: server-side request forgery (SSRF) with full response disclosure in the Lara Builder markdown fetch feature.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Lara Dashboard versions 0.9.2 through 1.3.1 contain a server-side request forgery vulnerability that enables authenticated content editors to retrieve internal network traffic and cloud metadata-including AWS IAM credentials-by routing requests through the application server. Organizations running affected versions face credential theft and potential infrastructure compromise via insider exploitation by any content editor account.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Laradashboard
View allImproper privilege management in LaraDashboard before 1.4.8 lets an authenticated Admin-tier user who holds the role.edi
Authentication bypass in Lara Dashboard before 1.3.0 lets unauthenticated attackers log in as any registered user by req
LaraDashboard through 1.4.2 lets any administrator holding the ordinary settings.edit permission - which the default Adm
Information disclosure in LaraDashboard before 1.4.8 allows an authenticated user who holds only the low-privilege setti
Unauthenticated attackers can exhaust LaraDashboard's paid email-verification quota through the public forgot-password a
Path traversal in LaraDashboard before 1.4.8 lets unauthenticated remote attackers read arbitrary JSON files from the ap
Race condition in LaraDashboard 1.4.0 through 1.4.7 allows unauthenticated remote attackers to bypass the per-IP daily r
Open redirect in LaraDashboard before 1.4.8 allows remote attackers to steer an authenticated user who holds email-templ
Improper authorization in LaraDashboard 1.4.0 through 1.4.8 lets an authenticated user holding only the read-only email_
Stored cross-site scripting in LaraDashboard 1.4.8 and earlier lets any authenticated account holding the post.create or
Exploit-DB