Incomplete Comparison with Missing Factors Affecting backpack/crud package, versions >=6.0.0, <6.8.14>=7.0.0, <7.0.38

backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5

Affected versions of this package are vulnerable to Incomplete Comparison with Missing Factors via the color column rendering process in the Blade template, where the escaped and unescaped branches are inverted. An attacker can execute arbitrary JavaScript in the browser of users viewing affected pages by injecting malicious values into the color column. This can lead to theft of session cookies and CSRF tokens. This is only exploitable if an attacker is able to write unsanitized values into a color-typed column.

This vulnerability can be mitigated by validating stored color values against a strict CSS color grammar (e.g., /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the view.

• GitHub Advisory
• GitHub Release
• GitHub Release