CVE-2024-29644: dcat/laravel-admin Cross Site Scripting vulnerability
Summary
CVE-2024-29644: dcat-admin Cross Site Scripting vulnerability. Affects dcat/laravel-admin versions < 2.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dcat/laravel-admin is a package available on Packagist that provides an administration panel for Laravel applications. It offers various features and functionalities to manage and control the backend of a Laravel application. However, versions up to 2.1.3 are vulnerable to a Cross Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in dcat/laravel-admin allows a remote attacker to execute arbitrary code by injecting a crafted script into the user login box. This can lead to the execution of malicious actions, such as stealing user credentials, session hijacking, or defacing the application. The vulnerability is rated as moderate severity with a CVSS score of 6.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the user login box or implement input sanitization to prevent script injection. Here is an example of how to disable the user login box in your application:
// Disable user login box
config(['admin.auth.disable_login' => true]);
Conclusion
The dcat/laravel-admin package up to version 2.1.3 is vulnerable to a Cross Site Scripting (XSS) attack. This can allow an attacker to execute arbitrary code and potentially compromise the application. It is crucial to upgrade to the latest patched version (2.1.4 or later) or apply the provided workaround to mitigate the vulnerability.
See every vulnerability recorded for dcat/laravel-admin →
FAQ
The vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized access, data theft, or application defacement.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the composer.lock file.
Yes, the maintainers of dcat/laravel-admin have released a fix in version 2.1.4 or later. It is recommended to upgrade to the latest version to mitigate the vulnerability.
If upgrading immediately is not possible, you can disable the user login box or implement input sanitization to prevent script injection. Refer to the provided workaround section for more details.
The vulnerability is rated as moderate severity with a CVSS score of 6.1.
Related vulnerabilities
Recent vulnerabilities recorded for dcat/laravel-admin.
