PT-2024-24353 · Winter Cms · Wn-Dusk-Plugin

Bennothommo

·

Published

2024-04-12

·

Updated

2024-04-15

·

CVE-2024-32003

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions wn-dusk-plugin versions prior to 2.1.0
Description The Dusk plugin provides special routes as part of its testing framework, allowing a browser environment to act as a user in the Backend or User plugin without authentication. The route [[URL]]/ dusk/login/[[USER ID]]/[[MANAGER]] can potentially be used to gain access to any user account without authentication if the Dusk plugin is available publicly and test cases are run with live data. This issue affects Winter CMS installations that meet specific criteria, including having the Dusk plugin installed, being in production mode, and using production data for testing.
Recommendations To resolve the issue, upgrade to version 2.1.0 or later. As a temporary workaround, consider setting the APP ENV environment variable to dusk to prevent the special routes from being registered. Restrict access to the Dusk plugin and its configuration to minimize the risk of exploitation. Avoid using the Dusk plugin in production instances and install it as a development dependency only in Composer.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

Related Identifiers

CVE-2024-32003
GHSA-CHCP-G9J5-3XXX

Affected Products

Wn-Dusk-Plugin