GHSA-rjjq-v76w-8jh4: LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated administrator who is not a Superadmin can exploit it if they have the settings.edit permission. Unauthenticated users and administrators without that permission are not identified as affected by the available information.
What access does successful exploitation provide?
The affected core-upgrade actions allow the attacker to create and download backups, which can expose database dumps containing password hashes. They can also restore backups or initiate site upgrades.
Are default deployments affected?
The available information does not state whether settings.edit is granted to non-Superadmin administrators by default. Exposure depends on whether such an administrator account exists with that permission.
What can be done while patching is delayed?
Restrict settings.edit so it is not assigned to non-Superadmin administrators, particularly accounts that do not require settings administration. Limit access to the core-upgrades backup, download, restore, and upgrade actions where possible.
How can administrators check for potential exploitation?
Review access and audit records for requests to /admin/settings/core-upgrades, especially backup creation, download, restore, and upgrade actions performed by non-Superadmin accounts with settings.edit. Review whether database backup files may have been downloaded, since they can contain password hashes.