Laradashboard
Monthly
Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTTP requests through the application server via the markdown fetch API endpoint, with the server returning response bodies verbatim to the caller. The POST /api/admin/builder/markdown/fetch endpoint validated only URL format (not destination host), enabling requests to internal services and cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, which can yield IAM role temporary credentials. No public exploit identified at time of analysis; vendor-released patch is available in v1.3.2.
Authentication bypass in Lara Dashboard before 1.3.0 lets unauthenticated attackers log in as any registered user by requesting GET /screenshot-login/{email}, provided the deployment runs with APP_ENV set to anything other than production. The route was a demo-screenshot helper (used by an internal Browsershot command with superadmin@example.com) that was reachable in non-production environments, granting a fully authenticated session that reaches user administration, settings, database contents, and arbitrary code execution via the module installer. Reported by VulnCheck with a vendor patch available (v1.3.0); no public exploit identified at time of analysis, though the trivial GET-based technique is effectively self-documenting.
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.
Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTTP requests through the application server via the markdown fetch API endpoint, with the server returning response bodies verbatim to the caller. The POST /api/admin/builder/markdown/fetch endpoint validated only URL format (not destination host), enabling requests to internal services and cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, which can yield IAM role temporary credentials. No public exploit identified at time of analysis; vendor-released patch is available in v1.3.2.
Authentication bypass in Lara Dashboard before 1.3.0 lets unauthenticated attackers log in as any registered user by requesting GET /screenshot-login/{email}, provided the deployment runs with APP_ENV set to anything other than production. The route was a demo-screenshot helper (used by an internal Browsershot command with superadmin@example.com) that was reachable in non-production environments, granting a fully authenticated session that reaches user administration, settings, database contents, and arbitrary code execution via the module installer. Reported by VulnCheck with a vendor patch available (v1.3.0); no public exploit identified at time of analysis, though the trivial GET-based technique is effectively self-documenting.
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.