CVE-2024-54775: Dcat-Admin Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2024-54775: Dcat-Admin Cross-Site Scripting (XSS) vulnerability. Affects dcat/laravel-admin versions 2.2.0-beta. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dcat-Admin is a powerful administrative interface for Laravel applications, designed to simplify the management of backend functionalities. It offers features such as user authentication, role management, and customizable dashboards. However, versions 2.2.0-beta and 2.2.2-beta are susceptible to a Cross-Site Scripting (XSS) vulnerability, which can be exploited through specific admin routes.
Vulnerability Detail
The vulnerability arises from improper input validation in the Dcat-Admin package, specifically in the '/admin/auth/menu' and '/admin/auth/extensions' routes. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, data theft, or other malicious actions. The vulnerability is classified under CWE-79, indicating its nature as a Cross-Site Scripting issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the vulnerable routes by modifying your application's routing configuration to prevent unauthorized users from accessing '/admin/auth/menu' and '/admin/auth/extensions'. This can be done by implementing proper authentication checks in your routes.
Conclusion
The Dcat-Admin Cross-Site Scripting vulnerability (CVE-2024-54775) poses a moderate risk to applications using versions 2.2.0-beta and 2.2.2-beta. It is crucial to update to a patched version to mitigate potential security risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for dcat/laravel-admin →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and session information.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By checking your composer.lock file, you can determine if your application is affected. Visit the Vulert playground at Vulert Scanner for a quick check without signup.
If exploited, this XSS vulnerability can lead to unauthorized access to user sessions, data theft, and the execution of malicious scripts in the context of the affected user's browser.
Yes, updating to a non-vulnerable version of the Dcat-Admin package will resolve the issue. Ensure you run 'composer update dcat/laravel-admin' to get the latest version.
If immediate updates are not possible, implement access restrictions to the affected routes as a temporary workaround until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for dcat/laravel-admin.
