1- Click RCE Vulnerability in Voyager PHP Allow Attackers Execute Arbitrary Code

A recently disclosed security vulnerability in the Voyager PHP package, a popular tool for managing Laravel applications, has raised significant concerns regarding the potential for remote code execution (RCE) on affected servers.

This vulnerability, identified through ongoing security scans using SonarQube Cloud, could allow an authenticated user to inadvertently execute arbitrary code by clicking on a specifically crafted link.

As of now, no patches have been released by the maintainers of Voyager to address these critical issues.

Vulnerability Details

The vulnerability stems from an arbitrary file write issue within the Voyager’s media upload functionality.

During the upload process, the application checks the MIME type of files to ensure they align with a predefined list. However, this mechanism is flawed.

Attackers may exploit this weakness by crafting polyglot files that can be interpreted as multiple types.

For example, a malicious PHP script can be disguised as an image or video file.

Since the application does not adequately verify file extensions, an attacker could upload such a file, leading to the execution of arbitrary PHP code on the server.

Moreover, the vulnerability is exacerbated by the presence of a reflected cross-site scripting (XSS) flaw.

The Voyager application allows execution of certain administrative actions via GET requests to its /admin/compass endpoint.

If an attacker tricks an authenticated user into clicking a malicious link, they could execute arbitrary JavaScript code, further escalating the risk of server compromise.

Impact Assessment

The implications of these vulnerabilities are significant, particularly for applications that rely heavily on the Voyager package, which boasts over 11,000 stars on GitHub.

Although the immediate threat level is mitigated by the requirement for the clicking user to have appropriate permissions, the potential for unauthorized code execution poses serious risks within compromised administrative contexts.

According to the Sonar, Voyager has not provided a fix for these vulnerabilities, despite multiple outreach attempts from the security research team.

Consequently, the vulnerabilities remain unpatched in Voyager version 1.8.0, urging users to evaluate the risks associated with deploying this package in production environments.

The discovery of these vulnerabilities highlights a critical need for vigilance among developers and system administrators utilizing the Voyager PHP package.

Organizations are strongly advised to audit their use of Voyager, enforce strict user permissions, and consider alternative solutions until appropriate patches are released.

As the security landscape evolves, continuous monitoring and proactive measures remain essential to safeguard against such vulnerabilities.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free