An unauthenticated remote code execution vulnerability in Laravel-Backpack CRUD allows attackers to inject operating system commands, posing a critical risk to server integrity and data confidentiality.

The vulnerability exists in the Backpack\CRUD\Stats::makeCurlRequest function, which fails to properly neutralize input derived from the HTTP Host header before passing it to an exec() system call. An unauthenticated attacker can manipulate this header to execute arbitrary OS commands as the web server user.

Successful exploitation grants the attacker the ability to execute commands with the privileges of the web server user. This can lead to the exfiltration of sensitive environment secrets, unauthorized modification of application data, or total service disruption. With a CVSS score of 8.1, this represents a high-severity risk that could lead to complete system compromise if the server environment is not strictly hardened.

Immediate Action: Update the Laravel-Backpack CRUD package to version 4.1.72, 5.6.2, 6.8.13, 7.0.36, or newer immediately.

Proactive Monitoring: Monitor server access logs for suspicious HTTP Host headers containing shell metacharacters and review system logs for unexpected child processes spawned by the web server.

Compensating Controls: Implement strict HTTP Host header validation at the load balancer or reverse proxy level to reject malformed requests before they reach the application. Disabling the exec() function in the PHP configuration can also prevent this specific command injection vector.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability should be treated as a priority for all administrators using the Laravel-Backpack CRUD package. Organizations must apply the specified security updates immediately to eliminate the underlying flaw in the command construction logic.