Description
Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IAM credentials by supplying malicious URLs without host validation or redirect restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| laradashboard | laradashboard | 0.9.2 – < 1.3.2 | 1.3.2 |
References
- GitHub Security Advisory (GHSA-4xqv-4c27-6c4j) vendor-advisory
- GitHub Security Advisory (GHSA-f36j-h77g-6wj8) vendor-advisory
- Fix commit adding SafeUrlValidator patch
- Unguarded server-side fetch at v1.3.1 technical-description
- Same unguarded fetch at v0.9.2, the first release carrying the service technical-description
- Controller with no authorization check at v1.3.1 technical-description
- Host allowlist introduced in v1.3.2 technical-description
- laradashboard v1.3.2 Release Notes release-notes
- https://github.com/laradashboard/laradashboard product
- VulnCheck Advisory: Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch third-party-advisory