Threats tagged 'ghsa-chv8-5vwm-w6cj'

rConfig Core versions before 8.2.19 and rConfig Pro versions before 8.4.1 have a critical deserialization of untrusted data vulnerability. This flaw allows unauthenticated network attackers to execute arbitrary code by pushing crafted serialized jobs onto a Redis-backed Laravel Horizon queue that runs without authentication. The vulnerability arises because Laravel's CallQueuedHandler unserializes jobs without class restrictions, enabling attackers to instantiate a specific job class and execute attacker-controlled Artisan commands. Exploitation can lead to arbitrary PHP and OS command execution, persistent web shell installation, and disclosure of sensitive credentials. If Redis is not directly accessible, authenticated attackers can still exploit the vulnerability via the application by targeting the server's loopback address.