CVE-2024-55556
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this vulnerability relies on an attacker obtaining Laravel's secret APP_KEY, which would allow them to decrypt and manipulate session cookies (laravel_session) containing serialized data. By altering this data and re-encrypting it with the APP_KEY, the attacker could trigger arbitrary deserialization on the server, potentially leading to remote command execution (RCE). The vulnerability is primarily exploited by accessing an exposed cookie and manipulating it using the secret key to gain malicious access to the server.
Analysis
Crater Invoice application allows unauthenticated remote command execution through Laravel session cookie deserialization when the APP_KEY is known. Attackers who obtain the application key can forge session cookies containing serialized PHP objects that execute arbitrary commands on the server.
Technical Context
Crater uses Laravel's encrypted session handling, which encrypts and signs session data using the APP_KEY. If an attacker obtains the APP_KEY (through source code exposure, .env file disclosure, or debug mode), they can encrypt a malicious serialized PHP object as the laravel_session cookie. When the server decrypts and deserializes the cookie, the object's magic methods execute arbitrary code.
Affected Products
['Crater Invoice (all versions)']
Remediation
Regenerate the APP_KEY and rotate immediately if exposure is suspected. Ensure .env files are not web-accessible and excluded from version control. Disable debug mode in production. Implement file integrity monitoring on the .env file. Consider upgrading Laravel to versions with serialization protections.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today