Arbitrary File Upload and RCE in Lara Dashboard

Lara Dashboard versions before 1.3.2 contain an authorization flaw in the /admin/settings/core-upgrades/upload endpoint. The application incorrectly restricts access to this endpoint to the 'settings.edit' permission rather than enforcing 'Superadmin' status. This vulnerability allows an authenticated administrator with limited permissions to upload and extract arbitrary ZIP archives. By crafting a malicious archive, an attacker can overwrite critical application files, such as 'routes/web.php', with payloads containing system commands. These commands execute in the context of the web server user, providing the attacker with full control over the application environment, including access to database credentials and environment secrets. This attack allows for persistence and full system compromise, impacting the confidentiality, integrity, and availability of the host application.

Attack Chain

1. Attacker authenticates to the Lara Dashboard using valid administrative credentials that possess the 'settings.edit' permission.
2. Attacker navigates to the core-upgrades administrative panel within the dashboard interface.
3. Attacker crafts a malicious ZIP archive containing weaponized PHP files designed to overwrite existing application source code.
4. Attacker performs an HTTP POST request to '/admin/settings/core-upgrades/upload' containing the malicious ZIP archive.
5. The application validates the 'settings.edit' permission and proceeds to extract the archive to the web application's root directory.
6. The uploaded malicious PHP files overwrite legitimate application source code, such as 'routes/web.php'.
7. Attacker triggers the execution of the injected code by requesting the modified PHP file via a browser or script.
8. Arbitrary system commands are executed with the privileges of the web server user, resulting in credential exfiltration or full system compromise.

Impact

Successful exploitation leads to full remote code execution, enabling attackers to extract sensitive environment secrets, access database credentials, and gain persistence on the server. The target is the Lara Dashboard application, specifically affecting installations prior to version 1.3.2.

Recommendation

Prioritize the upgrade of all Lara Dashboard instances to version 1.3.2 or later to address the insufficient authorization check on the file upload endpoint.