Description
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| venturedrake | laravel-crm | < 2.4.0 | 2.4.0 |
References
- https://github.com/venturedrake/laravel-crm/issues/79 issue-tracking
- https://github.com/venturedrake/laravel-crm/issues/80 issue-tracking
- DealIndex actions with no authorization at 2.3.0 technical-description
- Activities routes with auth only at 2.3.0 technical-description
- Merge of PR #89: can: middleware on Activities and product routes patch
- https://github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583c586 patch
- https://github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35bbb0 patch
- https://github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a34820122c3 patch
- laravel-crm 2.4.0 Release Notes release-notes
- https://github.com/venturedrake/laravel-crm product
- VulnCheck Advisory: VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions third-party-advisory