Alibek Baxtiyarov

**Name of the Vulnerable Software and Affected Versions** InvoiceNinja version 5-stable **Description** An authenticated user with invoice creation permissions can inject HTML or JavaScript payloads into the `terms` field of an invoice or quote. This occurs because the application renders this field in the client portal using a raw output directive without HTML sanitization. The `StoreInvoiceRequest.php` file only removes newlines and does not purify the HTML content. An attacker can exploit this by using the 'PUT /api/v1/invoices/{id}' API endpoint to set the `terms` variable, leading to script execution in the client's browser, which may result in session cookie theft and account takeover. **Recommendations** As a temporary mitigation, restrict access to the 'PUT /api/v1/invoices/{id}' API endpoint or avoid using the `terms` parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Magistrala (affected versions not specified) **Description** The Rules Engine allows authenticated users to create rules containing embedded Go or Lua scripts that are executed server-side upon the arrival of IoT messages. The Go script engine, located in `re/golang.go`, utilizes the Yaegi interpreter and exposes the full Go standard library, including `os` and `net/http`. Validation is limited to a regex that blocks `panic()` calls and goroutines, leaving dangerous functions such as `os.ReadFile()`, `os.WriteFile()`, `os.Remove()`, and `os.Environ()` accessible. The Lua script engine, located in `re/lua.go`, lacks input validation and preloads libraries that enable arbitrary database access (`db`), file I/O (`ioutil`), Server-Side Request Forgery (SSRF) via an HTTP client, and path traversal (`filepath`). Consequently, an authenticated low-privileged user can perform arbitrary file read/write operations, leak environment variables, access the database, and execute SSRF attacks against internal microservices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the ability of low-privileged users to create or modify rules within the Rules Engine. Restrict access to the `re/golang.go` and `re/lua.go` components to prevent unauthorized script execution.