CVE-2021-32924
📋 TL;DR
This vulnerability allows authenticated moderators in Invision Community (IPS Community Suite) to execute arbitrary PHP code via eval injection in the theme preview functionality. It affects all installations before version 4.6.0, enabling remote code execution with moderator privileges.
💻 Affected Systems
- Invision Community
- IPS Community Suite
📦 What is this software?
Ips Community Suite by Invisioncommunity
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, malware deployment, lateral movement, and complete system takeover.
Likely Case
Moderator-level attackers gaining administrative access, defacing websites, stealing user data, and installing backdoors.
If Mitigated
Limited impact if proper access controls restrict moderator privileges and network segmentation is in place.
🎯 Exploit Status
Exploit requires authenticated moderator access; public exploit code available on Packet Storm and other sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.0 and later
Vendor Advisory: https://invisioncommunity.com/features/security/
Restart Required: No
Instructions:
1. Backup your installation and database. 2. Download Invision Community 4.6.0 or later from the client area. 3. Upload files to overwrite existing installation. 4. Run the upgrader at /admin/upgrade. 5. Clear system cache in AdminCP.
🔧 Temporary Workarounds
Disable CMS/Pages Module
allTemporarily disable the vulnerable CMS/pages module if not required
Restrict Moderator Access
allReview and restrict moderator privileges to essential functions only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the application server
- Enable detailed logging and monitoring for eval() function calls and theme preview activities
🔍 How to Verify
Check if Vulnerable:
Check AdminCP dashboard for version number; if below 4.6.0, you are vulnerable.Check Version:
Check AdminCP dashboard or view source of any page for version meta tagsVerify Fix Applied:
Confirm version is 4.6.0 or higher in AdminCP and test theme preview functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual eval() calls in PHP logs
- Theme preview requests with suspicious parameters
- Moderator account performing unexpected actions
Network Indicators:
- POST requests to /index.php?app=cms&module=pages&controller=builder with eval-like payloads
SIEM Query:
source="php_error.log" AND "eval()" AND "IPS\\cms\\modules\\front\\pages\\_builder"🔗 References
- http://karmainsecurity.com/KIS-2021-04
- http://packetstormsecurity.com/files/162868/IPS-Community-Suite-4.5.4.2-PHP-Code-Injection.html
- http://seclists.org/fulldisclosure/2021/May/80
- https://hackerone.com/reports/1092574
- https://invisioncommunity.com/features/security/
- http://karmainsecurity.com/KIS-2021-04
- http://packetstormsecurity.com/files/162868/IPS-Community-Suite-4.5.4.2-PHP-Code-Injection.html
- http://seclists.org/fulldisclosure/2021/May/80
- https://hackerone.com/reports/1092574
- https://invisioncommunity.com/features/security/
