Rémi Matasse

**Name of the Vulnerable Software and Affected Versions** Invoice Ninja versions prior to 5.10.43 **Description** The issue allows remote code execution from a pre-authenticated route when an attacker knows the `APP KEY`. This is exacerbated by .env files that have default `APP KEY` values. The route `route/{hash}` defined in the invoiceninja/routes/client.php file can be accessed without authentication. The parameter `{hash}` is passed to the `decrypt` function that expects a Laravel ciphered value containing a serialized object. Laravel contains several gadget chains that can be used to trigger remote command execution from arbitrary deserialization. Therefore, an attacker in possession of the `APP KEY` can fully control a string passed to an `unserialize` function. **Recommendations** For versions prior to 5.10.43, upgrade to version 5.10.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the `route/{hash}` route or disabling the `decrypt` function until a patch is applied. Additionally, ensure that default `APP KEY` values from .env files are changed to unique, secure values to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Crater Invoice (affected versions not specified) **Description** A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the `APP KEY` to achieve remote command execution on the server by manipulating the `laravel session` cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector relies on an attacker obtaining Laravel's secret `APP KEY`, which would allow them to decrypt and manipulate session cookies containing serialized data. By altering this data and re-encrypting it with the `APP KEY`, the attacker could trigger arbitrary deserialization on the server, potentially leading to remote command execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Snipe-IT versions prior to 7.0.10 **Description** The issue allows remote code execution when an attacker knows the `APP KEY`, which is associated with cookie serialization. This is worsened by the availability of .env files from the product's repository that contain default `APP KEY` values. **Recommendations** For versions prior to 7.0.10, update to version 7.0.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the `APP KEY` and ensuring that .env files do not contain default values.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.4.187 **Description** The issue arises from the `add misp export` function in `app/Controller/EventsController.php` not properly checking for a valid file upload. This could potentially lead to security weaknesses. **Recommendations** For versions prior to 2.4.187, update to version 2.4.187 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** MISP versions prior to 2.4.187 **Description** The issue concerns a weak security check in the ` uploadLogo` function within the `OrganisationsController.php` file. This function does not properly validate logo uploads. **Recommendations** For versions prior to 2.4.187, update to version 2.4.187 or later to resolve the issue. As a temporary workaround, consider disabling the ` uploadLogo` function in `OrganisationsController.php` until a patch is available. Restrict access to the logo upload feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Backup Migration plugin for WordPress versions up to, and including, 1.3.7 **Description** The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include statement, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server. The estimated number of potentially affected devices worldwide is around 50,000 to 90,000 websites. **Recommendations** Update the Backup Migration plugin to version 1.3.8 or later to resolve the issue. As a temporary workaround, consider disabling the `includes/backup-heart.php` file until a patch is available. Restrict access to the vulnerable `backup-heart.php` file to minimize the risk of exploitation. Avoid using the Backup Migration plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PhpWeasyPrint versions prior to 2.6.0 **Description** PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The software uses a case-sensitive blacklist to protect output filenames against the `phar://` stream wrapper. Because PHP stream wrappers are case-insensitive, using variations such as `PHAR://` or `Phar://` bypasses this check and reaches the `fileExists()` (`file exists()`) function within `prepareOutput()`. On PHP 7 (specifically 7.4+), this allows the deserialization of crafted PHAR archive metadata, which can lead to remote code execution. **Recommendations** Update to version 2.6.0.