CVE-2024-51758: Filament Actions Package Exposes Exported Files on Public Disk
Summary
CVE-2024-51758: Filament has exported files stored in default (public) filesystem if not reconfigured. Affects filament/actions versions >= 3.2.0, < 3.2.123. Fixed in 3.2.123. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Filament is a popular PHP package designed to streamline the development of admin panels and interfaces. It provides various features including file uploads, data exports, and customizable actions. The package is built to facilitate quick development, allowing users to easily switch storage drivers for production environments. However, its default configuration sets the storage disk to 'public', which can lead to security vulnerabilities if not properly reconfigured.
Vulnerability Detail
The vulnerability arises from the default configuration of the Filament Actions package, which saves exported files to a public disk. This configuration can expose sensitive data to unauthorized users, as files stored on the public disk can be accessed without proper access controls. The issue is particularly concerning for applications that do not change the default disk setting before deployment, potentially leading to data leaks and compliance violations. The vulnerability is classified under CWE-1188, indicating the risks associated with insecure default settings.
How To Fix
Minimum fixed version
3.2.123
This is the first release that contains the fix.
composer require filament/actions:3.2.123Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you need to continue using the public disk for exports, you can explicitly set the export disk in your configuration. Refer to the Filament documentation for instructions on customizing the storage disk for exports: https://filamentphp.com/docs/3.x/actions/prebuilt-actions/export#customizing-the-storage-disk.
Conclusion
The CVE-2024-51758 vulnerability in the Filament Actions package highlights the importance of secure default configurations in software development. By updating to the latest version and reviewing your storage settings, you can protect your application from unauthorized data access.
See every vulnerability recorded for filament/actions →
FAQ
CVE-2024-51758 is a security vulnerability in the Filament Actions package that allows unauthorized access to exported files stored on a public disk.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
Leaving the public disk as the default can expose sensitive exported data to unauthorized users, leading to potential data breaches and compliance issues.
You can update the package by running 'composer update filament/actions' in your terminal to ensure you are using the latest version with the security fix.
If an immediate update is not possible, consider changing the default disk to 'local' or 's3' in your configuration to mitigate the risk until you can apply the update.
