DevDojo Voyager Command Injection Vulnerability in Laravel 8

A command injection vulnerability has been identified in DevDojo Voyager versions 1.4.0 to 1.8.0, when used with Laravel 8 or later. This vulnerability allows authenticated administrators to execute arbitrary operating system commands through a specific php artisan command, due to inadequate input validation.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of system commands, potentially allowing for further exploitation of the application or server.

Reproduction

To reproduce this vulnerability, an authenticated administrator must access the '/admin/compass' endpoint. From there, a php artisan command can be executed that includes the desired operating system command as a payload. This can be done by injecting the command into the command execution feature of the Voyager Compass.

Remediation

It is recommended to disable the Compass feature ('/admin/compass') if it is not needed.