PT-2024-23216 · Invision Power Services · Invision Community

Egidio Romano · Published 2024-04-08 · Updated 2024-07-03 · CVE-2024-30162

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Invision Community versions prior to 4.7.17

Description The issue allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPScoremodulesadmineditor toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.

Recommendations For versions prior to 4.7.17, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider disabling the IPScoremodulesadmineditor toolbar::addPlugin() method until a patch is available. Restrict access to the applications/core/interface/ckeditor/ckeditor/plugins/ directory to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-30162

Affected Products

Invision Community

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-30162 · Security Note
• https://twitter.com/VulmonFeeds/status/1799149077818413339 · Twitter Post
• https://twitter.com/CVEnew/status/1799131427470021102 · Twitter Post
• https://twitter.com/elhackernet/status/1779898691064656375 · Twitter Post
• https://invisioncommunity.com · Note
• https://twitter.com/autumn_good_35/status/1777290094204129767 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Apr/21 · Note
• https://twitter.com/zoomeye_team/status/1777538105484165566 · Twitter Post