CVE-2024-42485: Path Traversal Attack on Filament Excel Export Download Endpoint
Summary
CVE-2024-42485: Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint. Affects pxlrbt/filament-excel across 2 version ranges.
< 1.1.14
>= 2.0.0-alpha, < 2.3.3
Fixed in 1.1.14 or 2.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Filament Excel is a package available on Packagist that provides functionality for exporting Excel files. It is vulnerable to a path traversal attack on the export download endpoint. This vulnerability allows an attacker to download any file from the server without authentication, as long as the webserver allows the use of '../' in the URL.
Vulnerability Detail
The export download route /filament-excel/{path} in Filament Excel is susceptible to a path traversal attack. By manipulating the '{path}' parameter and including '../' sequences, an attacker can navigate to directories outside the intended scope and download arbitrary files. This can lead to unauthorized access to sensitive information or the execution of malicious code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.141.1.14composer require pxlrbt/filament-excel:1.1.14 -
>= 2.0.0-alpha, < 2.3.32.3.3composer require pxlrbt/filament-excel:2.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately possible, a temporary workaround is to implement server-side input validation to prevent the inclusion of '../' sequences in the '{path}' parameter. This can be achieved by checking the parameter for any occurrences of '../' and rejecting the request if found.
Conclusion
The path traversal vulnerability in Filament Excel's export download endpoint allows unauthorized file downloads. It is crucial to update to version 2.3.3 or later to fix the vulnerability. Implementing server-side input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for pxlrbt/filament-excel →
FAQ
The vulnerability allows an attacker to download any file from the server without authentication. This can lead to unauthorized access to sensitive information or the execution of malicious code.
Updating Filament Excel to version 2.3.3 or later will fix the vulnerability. Alternatively, implementing server-side input validation to prevent the inclusion of '../' sequences in the '{path}' parameter can serve as a temporary workaround.
There are no known exploits for this vulnerability at the moment. However, it is crucial to address the issue promptly to prevent potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker can send crafted requests to the export download endpoint and download arbitrary files from the server.
Yes, the vulnerability has been patched in Filament Excel version 2.3.3. It is recommended to update to this version or later to ensure the security of the application.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
