CVE-2024-12362
📋 TL;DR
This CVE describes a path traversal vulnerability in InvoicePlane's invoices.php file that allows attackers to access arbitrary files on the server by manipulating invoice parameters. The vulnerability affects InvoicePlane installations up to version 1.6.1 and can be exploited remotely without authentication. Organizations using vulnerable versions of InvoicePlane for invoicing and billing are at risk.
💻 Affected Systems
- InvoicePlane
📦 What is this software?
Invoiceplane by Invoiceplane
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files, configuration files, or application data, potentially leading to credential theft, data exfiltration, or further system compromise.
Likely Case
Attackers access application configuration files, source code, or other files within the web directory, potentially obtaining database credentials or other sensitive information.
If Mitigated
With proper file permissions and web server configuration, impact is limited to files accessible by the web server user, preventing access to critical system files.
🎯 Exploit Status
Exploit details are publicly available in the GitHub pull request and vulnerability databases.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.2-beta-1
Vendor Advisory: https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1
Restart Required: No
Instructions:
1. Backup your current InvoicePlane installation and database. 2. Download version 1.6.2-beta-1 from GitHub releases. 3. Replace the vulnerable files with patched versions. 4. Verify the application functions correctly.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize invoice parameters before processing
Modify invoices.php to validate and sanitize the 'invoice' parameter using realpath() and checking for directory traversal sequences
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block path traversal patterns in requests
- Restrict file system permissions for the web server user to limit accessible directories
🔍 How to Verify
Check if Vulnerable:
Check InvoicePlane version in application settings or by examining the source code version markersCheck Version:
Check the application dashboard or examine the application's configuration files for version informationVerify Fix Applied:
Verify the application version is 1.6.2-beta-1 or later and test the download functionality with path traversal attempts📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests containing '../' sequences in invoice parameters
- Access to files outside expected invoice directories
Network Indicators:
- HTTP requests with path traversal sequences in parameters
- Unusual file download patterns from the invoices endpoint
SIEM Query:
web.url:*invoices.php* AND (web.param:*../* OR web.param:*..\*)