Executive brief
Lara Dashboard is a Laravel-based content management system used to administer users, roles, permissions, and application settings. A vulnerability in the markdown fetching feature allows authenticated users to make the application fetch arbitrary URLs and return the response, potentially exposing internal services, databases, and cloud credentials that should not be publicly accessible.
Technical details
The POST /api/admin/builder/markdown/fetch endpoint in Lara Dashboard through 1.3.1 is vulnerable to server-side request forgery (SSRF) due to insufficient URL validation in the MarkdownFetchService. An authenticated attacker can supply a malicious URL to retrieve responses from internal HTTP services, local metadata endpoints (e.g., AWS IAM credentials), or restricted internal resources. The vulnerability requires authentication but does not restrict redirect chains or enforce hostname validation. Responses are returned to the attacker, enabling data exfiltration from internal environments. The vulnerability affects versions up to 1.3.1.
Affected products
- Lara Dashboard Lara Dashboard through 1.3.1
Timeline
- 2026-09-09: disclosed