LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

Summary

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.

Remediation

1. Inventory every LaraDashboard LaraDashboard deployment, including staging.
2. Upgrade LaraDashboard LaraDashboard to 1.4.5.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532
• Advisoryhttps://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4
• Advisoryhttps://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades
• Referencehttps://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50
• Referencehttps://github.com/laradashboard/laradashboard/releases/tag/v1.4.5