Three vulnerabilities found within the open-source PHP bundle Voyager for managing Laravel functions may very well be used for distant code execution assaults.
The problems stay unfixed and may be exploited in opposition to an authenticated Voyager person that clicks on a malicious hyperlink.
Vulnerability researchers at SonarSource, a code high quality and safety firm, say that they tried to report the failings to the Voyager maintainers however obtained no reply inside the 90-day window the corporate gives as per its vulnerability disclosure coverage.
Vulnerability particulars
The SonarQube Cloud staff discovered the primary vulnerability in Voyager, an arbitrary file write, throughout its routine scans. Wanting nearer on the mission, they found further safety points that may very well be mixed to run one-click distant code execution assaults on reachable Voyager situations.
The three flaws are summarizes as follows:
- CVE-2024-55417 – Voyager’s media add characteristic permits attackers to add malicious information by bypassing MIME-type verification. By crafting a polyglot file that seems as a picture or video however incorporates executable PHP code, an attacker can obtain distant code execution if the file is processed on the server.
- CVE-2024-55416 – The /admin/compass endpoint in Voyager improperly sanitizes person enter, permitting attackers to inject JavaScript into popup messages. If an authenticated admin clicks on a malicious hyperlink, the script executes of their browser, doubtlessly permitting attackers to carry out actions on their behalf, together with escalating to distant code execution.
- CVE-2024-55415 – A flaw within the file administration system allows attackers to govern file paths and delete or entry arbitrary information on the server. By exploiting this, attackers can disrupt companies, erase crucial information, or extract delicate data.
In accordance with SonarQube Cloud researchers, they reported the three points to Voyager maintainers over e mail and GitHub since September 11, 2024, however obtained no communication again.
Within the 90-day disclosure interval, they tried a number of instances to acquire a reply and inform that the general public disclosure date was approaching.
The researchers say that in addition they opened a safety report by way of GitHub on November 28 and that they notified the Voyager maintainers that the 90-day disclosure window expired they usually have been about to share the technical particulars publicly.
Affect and proposals
Voyager is primarily utilized by Laravel builders who want a pre-built admin panel to handle their functions.
Typical customers are internet growth firms, startups, freelance builders, Laravel hobbyists, and customarily, small to medium-sized companies that use Laravel for inner instruments or CMS-based functions.
The Voyager mission is very common because it has been forked 2,700 instances on GitHub, obtained greater than 11,800 stars and counts hundreds of thousands of downloads.
On condition that the three flaws SonarQube found stay unpatched, Voyager customers ought to take into account limiting entry to trusted customers solely, limiting “browse_media” permissions to forestall unauthorized file uploads, and utilizing role-based entry management (RBAC) to reduce publicity.
Server-level safety measures embrace disabling the execution of PHP information, utilizing strict MIME sort validation to reject polyglot information, and frequently monitoring logs for uncommon file add or entry exercise.
If safety is crucial, keep away from utilizing Voyager in manufacturing environments till official patches are out, or take into account migrating to a different Laravel admin panel.
