Incorrect Authorization Affecting winter/wn-dusk-plugin package, versions <2.1.0

Affected versions of this package are vulnerable to Incorrect Authorization due to the plugin being misconfigured in certain installations. Specifically, the plugin introduces special routes for testing purposes that, if exposed publicly, can be exploited to bypass user authentication mechanisms for accessing backend or user accounts without proper credentials. This vulnerability hinges on the plugin being publicly accessible and its test cases being executed with live data. This plugin must be utilized solely in development environments, as recommended, to mitigate potential exploitation.

Note

This will only affect users in which the Winter CMS installation meets ALL the following criteria:

1. The Dusk plugin is installed in the Winter CMS instance.

2. The application is in production mode (ie. the debug config value is set to true in config/app.php).

3. The Dusk plugin's automatic configuration has been overridden, either by providing a custom .env.dusk file or by providing custom configuration in the config/dusk folder, or by providing configuration environment variables externally.

4. The environment has been configured to use production data in the database for testing, and not the temporary SQLite database that Dusk uses by default.

5. The application is connectable via the web.

• GitHub Advisory
• GitHub Release