CVE-2024-55415: DevDojo Voyager Path Traversal Vulnerability
Summary
CVE-2024-55415: DevDojo Voyager vulnerable to path traversal. Affects tcg/voyager versions < 1.8.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DevDojo Voyager is a popular package used for building admin panels in Laravel applications. It provides a user-friendly interface for managing various aspects of a web application, including database management, user roles, and content management. The package is widely adopted due to its ease of use and extensive features. However, versions up to 1.8.0 are vulnerable to a path traversal issue that could allow unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability in DevDojo Voyager arises from improper validation of user input, specifically in the /admin/compass route. This flaw allows an attacker to manipulate file paths, potentially leading to unauthorized access to files outside the intended directory. The ramifications of this vulnerability can be severe, as it may expose sensitive configuration files or user data, compromising the security of the entire application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the /admin/compass route by implementing additional authentication checks or by removing the route from your application until an update can be applied.
Conclusion
The CVE-2024-55415 vulnerability in DevDojo Voyager poses a significant risk due to its path traversal nature, allowing unauthorized access to sensitive files. It is essential to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for tcg/voyager →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized access to sensitive information.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The potential impacts include unauthorized access to sensitive files, exposure of configuration data, and possible compromise of user information, which can lead to further attacks.
Yes, a patch is available in version 1.8.1 of the DevDojo Voyager package. It is crucial to update to this version or later to mitigate the risk.
If you cannot update the package immediately, consider implementing additional access controls or removing the vulnerable route as a temporary measure until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for tcg/voyager.
