module
InvoiceShelf unauthenticated PHP Deserialization Vulnerability
| Disclosed | Created |
|---|---|
| 12/13/2024 | 03/14/2025 |
Disclosed
12/13/2024
Created
03/14/2025
Description
InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments, create professional
invoices & estimates and is based on the PHP framework Laravel.
InvoiceShelf has a Remote Code Execution vulnerability that allows remote unauthenticated attackers to conduct
PHP deserialization attacks. This is possible when the `SESSION_DRIVER=cookie` option is set on the default
InvoiceShelf .env file meaning that any session will be stored as a ciphered value inside a cookie.
These sessions are made from a specially crafted JSON containing serialized data which is then ciphered using
Laravel's encrypt() function.
An attacker in possession of the `APP_KEY` would therefore be able to retrieve the cookie, uncipher it and modify
the serialized data in order to get arbitrary deserialization on the affected server, allowing them to achieve
remote command execution. InvoiceShelf version `1.3.0` and lower is vulnerable.
As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,
potentially resulting in complete system compromise, data exfiltration, or unauthorized access
to sensitive information.
invoices & estimates and is based on the PHP framework Laravel.
InvoiceShelf has a Remote Code Execution vulnerability that allows remote unauthenticated attackers to conduct
PHP deserialization attacks. This is possible when the `SESSION_DRIVER=cookie` option is set on the default
InvoiceShelf .env file meaning that any session will be stored as a ciphered value inside a cookie.
These sessions are made from a specially crafted JSON containing serialized data which is then ciphered using
Laravel's encrypt() function.
An attacker in possession of the `APP_KEY` would therefore be able to retrieve the cookie, uncipher it and modify
the serialized data in order to get arbitrary deserialization on the affected server, allowing them to achieve
remote command execution. InvoiceShelf version `1.3.0` and lower is vulnerable.
As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,
potentially resulting in complete system compromise, data exfiltration, or unauthorized access
to sensitive information.
Authors
h00die-gr3y Rémi MatasseMickaël Benassouli
Platform
Linux,PHP,Unix
Architectures
php, cmd
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/linux/http/invoiceshelf_unauth_rce_cve_2024_55556
msf /(6) > show actions
...actions...
msf /(6) > set ACTION < action-name >
msf /(6) > show options
...show and set options...
msf /(6) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.