Dusk plugin vulnerability allows unauthorized access to user accounts

CVE-2024-32003

What is CVE-2024-32003?

The Dusk plugin provides integration of Laravel Dusk for browser testing within Winter CMS but exposes a significant vulnerability if misconfigured. It allows unauthenticated access to user accounts in the Backend or User plugin through a specific public route. This situation occurs when the plugin is publicly accessible in a production environment, combined with improper settings such as overridden configurations and live database usage for testing. To mitigate this vulnerability, the plugin must be restricted to development environments with stringent configuration, using environment variables to limit access routes. Users are strongly encouraged to upgrade to version 2.1.0 or above, where enhancements have been made to prevent unauthorized access.

References