CVE-2024-55555 — Invoice Ninja APP_KEY Deserialization RCE

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values.

Originally published on Rapid7 AttackerKB · 2025-03-07 · revised 2025-03-08

Overview

Laravel applications can become exploitable when cryptographic validation and decryption mechanisms are implemented unsafely. Synacktiv published this advisory where you can pull off arbitrary unserialization via decrypt in the application Invoice Ninja. The underlying attack scenario is described in detail in the Synacktiv advisory.

A useful component of the research is the Laravel Crypto Killer tool that was designed by Synacktiv team to support this type of attacks. Having this toolkit available in Metasploit that can be leveraged in the different exploits that are subject to these bad implementations of decryption mechanisms in Laravel PHP applications would be a welcome addition.

I created the LaravelCryptoKiller mixin together with an Invoice Ninja exploit to automate this attack pattern. You can find them both in this PR submission Invoice Ninja unauthenticated RCE [CVE-2024-55555] + Laravel Crypto Killer mixin #19897.

References

Credits

Rémi Matasse and Mickaël Benassouli from Synacktiv