Vulnerability · Published Jan 7, 2025 · Assigned by mitre
CVE-2024-55555
High 8.8
In plain English
A high-severity unsafe deserialization in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Official description
Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values. The route/{hash} route defined in the invoiceninja/routes/client.php file can be accessed without authentication. The parameter {hash} is passed to the function decrypt that expects a Laravel ciphered value containing a serialized object. (Furthermore, Laravel contains several gadget chains usable to trigger remote command execution from arbitrary deserialization.) Therefore, an attacker in possession of the APP_KEY is able to fully control a string passed to an unserialize function.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H