CVE-2024-55556 Details
Description
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this vulnerability relies on an attacker obtaining Laravel's secret APP_KEY, which would allow them to decrypt and manipulate session cookies (laravel_session) containing serialized data. By altering this data and re-encrypting it with the APP_KEY, the attacker could trigger arbitrary deserialization on the server, potentially leading to remote command execution (RCE). The vulnerability is primarily exploited by accessing an exposed cookie and manipulating it using the secret key to gain malicious access to the server.
A remote command execution vulnerability has been identified in Crater Invoice versions through 6.0.6. This issue allows an unauthenticated attacker to execute arbitrary commands on the server by manipulating the laravel_session cookie. The vulnerability arises from the use of Laravel's session management, where session data is encrypted and stored in cookies. An attacker with knowledge of the APP_KEY can decrypt this data, modify it to include malicious payloads, and then re-encrypt it before sending it back to the server. The exploitation process takes advantage of arbitrary deserialization, leading to remote command execution.
Users are advised to regenerate the APP_KEY if they have used the default value from the .env.example file. Additionally, migrating to InvoiceShelf, a maintained fork of Crater Invoice, is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 7, 2025CISA-ADP
Assessed Jan 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/crater-invoice/crater | [email protected] | ProductSource CodeVendor |
| https://www.synacktiv.com/ | [email protected] | Vendor |
| https://www.synacktiv.com/advisories/crater-invoice-unauthenticated-remote-command-execution-when-appkey-known | [email protected] | AdvisoryExploitRemedyTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Crater Invoice | <= 6.0.6 (semver) |
CPE
Remediation
| |
| InvoiceShelf | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 8, 2025 | CVE Modified | CISA-ADP |
| Jan 7, 2025 | New CVE Received | [email protected] |