Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability in the goodoneuz/pay-uz Laravel package allows unauthenticated attackers to execute arbitrary code on your server. The issue lies in an unprotected API endpoint that writes user-controlled data into executable PHP files, which are later run by the application. This could allow an attacker to take full control of your server.
- Reaches servers from the internet.
- Grants attackers server-wide control.
- Affects payment processing systems.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this by sending a crafted request to a vulnerable API endpoint. This request would overwrite existing payment hook files with malicious PHP code. The application then executes this code during normal payment processing, leading to remote code execution.
- Target is the API endpoint.
- No authentication is required.
- Input is directly written to executable files.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability is a critical remote code execution flaw in a payment package, making it highly attractive to attackers. The direct file overwrite with user-controlled input leading to RCE is a classic and effective attack pattern, and the vendor's acknowledgment that a mentioned secret token is irrelevant further confirms the exposure.
- Unauthenticated RCE
- Publicly accessible endpoint
- Payment processing context
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating or taking offline any services using the goodoneuz/pay-uz Laravel package version 2.2.24 or earlier. This vulnerability is critical, allows unauthenticated remote code execution, and is exposed via network. Immediate containment is necessary to prevent compromise.
- Block network access to the affected endpoint.
- Monitor for suspicious file write activity.
- Update package to a version that addresses the vulnerability.
