PT-2024-35730 · Unknown · Invoice Ninja

Published 2024-12-27 · Updated 2025-01-01 · CVE-2024-53353

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Invoice Ninja (affected versions not specified)

Description A Server-Side Request Forgery (SSRF) issue has been discovered in Invoice Ninja, an open-source invoicing platform. This flaw could allow attackers to access sensitive files, posing serious risks for users. The vulnerability can be exploited via PDF generation, allowing access to files like "/etc/passwd".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-53353

Affected Products

Invoice Ninja

References · 9

• https://twitter.com/TweetThreatNews/status/1872982166209999015 · Twitter Post
• https://twitter.com/GHak2learn27752/status/1872838392955686999 · Twitter Post
• https://twitter.com/Komodosec/status/1874486382640734691 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1872820949151825972 · Twitter Post
• https://twitter.com/TMJIntel/status/1873038452331008432 · Twitter Post
• https://twitter.com/fridaysecurity/status/1872820742334890235 · Twitter Post
• https://t.me/pentestingnews/54702 · Telegram Post
• https://twitter.com/arbennsh/status/1872553291697287617 · Twitter Post
• https://twitter.com/Dinosn/status/1872870020029792707 · Twitter Post