Laravel Nova Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Laravel Nova version 3.7.0. This issue allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to crash and become unresponsive.

Reproduction

To reproduce this vulnerability, an authenticated user can send simultaneous requests to the '/nova-api/metrics/sum-orders' endpoint, using a very high value for the 'range' parameter. In testing, sending 10 simultaneous requests with a range value of 3,000,000 was sufficient to crash the server.