Alibek Baxtiyarov

An authenticated user with invoice creation permissions can inject HTML or JavaScript payloads into the `terms` field of an invoice or quote. This occurs because the application renders this field in the client portal using a raw output directive without HTML sanitization. The `StoreInvoiceRequest.php` file only removes newlines and does not purify the HTML content. An attacker can exploit this by using the 'PUT /api/v1/invoices/{id}' API endpoint to set the `terms` variable, leading to script execution in the client's browser, which may result in session cookie theft and account takeover.

The Rules Engine allows authenticated users to create rules containing embedded Go or Lua scripts that are executed server-side upon the arrival of IoT messages. The Go script engine, located in `re/golang.go`, utilizes the Yaegi interpreter and exposes the full Go standard library, including `os` and `net/http`. Validation is limited to a regex that blocks `panic()` calls and goroutines, leaving dangerous functions such as `os.ReadFile()`, `os.WriteFile()`, `os.Remove()`, and `os.Environ()` accessible. The Lua script engine, located in `re/lua.go`, lacks input validation and preloads libraries that enable arbitrary database access (`db`), file I/O (`ioutil`), Server-Side Request Forgery (SSRF) via an HTTP client, and path traversal (`filepath`). Consequently, an authenticated low-privileged user can perform arbitrary file read/write operations, leak environment variables, access the database, and execute SSRF attacks against internal microservices.