PT-2021-3467 · Unknown · Invoice Ninja

Ropwarejb · Published 2021-06-03 · Updated 2021-06-15 · CVE-2021-33898

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions prior to 4.4.0

Description The issue is related to an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php, which may allow an attacker to deserialize arbitrary PHP classes. This can result in remote code execution in certain contexts. The attacker's input must be hosted at http://www.geoplugin.net, and a successful attack requires spoofing that site or obtaining control of it.

Recommendations For versions prior to 4.4.0, update to version 4.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the unserialize() function in app/Ninja/Repositories/AccountRepository.php until a patch is available. Restrict access to the AccountRepository.php file to minimize the risk of exploitation. Avoid using the unserialize() function in the affected context until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-03331

CVE-2021-33898

Affected Products

Invoice Ninja

References · 5

• https://github.com/invoiceninja/invoiceninja/issues/5909 · Patch
• https://osv.dev/vulnerability/CVE-2021-33898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33898 · Security Note
• https://bdu.fstec.ru/vul/2021-03331 · Security Note
• https://t.me/cvenotify/15672 · Telegram Post