Description
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| laradashboard | laradashboard | 1.4.2 – < 1.4.8 | 1.4.8 |
References
- GitHub Security Advisory (GHSA-v36p-8578-8gch) vendor-advisory
- GitHub Security Advisory (GHSA-5hq2-r2f3-9vp9) vendor-advisory
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ForgotPasswordRequest.php#L22-L27 technical-description
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ResetPasswordRequest.php#L23-L30 technical-description
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailVerificationService.php#L95-L114 technical-description
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailDomainCheckService.php#L128 technical-description
- https://github.com/laradashboard/laradashboard/pull/339 patch issue-tracking
- https://github.com/laradashboard/laradashboard/commit/8babc803066a74c628fa012928fb1e6591411eba patch
- laradashboard v1.4.8 Release Notes release-notes
- https://github.com/laradashboard/laradashboard product
- VulnCheck Advisory: LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints third-party-advisory