Description
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| venturedrake | laravel-crm | < 2.4.0 | 2.4.0 |
References
- https://github.com/venturedrake/laravel-crm/issues/79 issue-tracking
- Role::find on the submitted role at 2.3.0 technical-description
- unscoped, unauthorized UserIndex::delete at 2.3.0 technical-description
- https://github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212 patch
- https://github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104 patch
- laravel-crm 2.4.0 Release Notes release-notes
- https://github.com/venturedrake/laravel-crm product
- VulnCheck Advisory: VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment third-party-advisory