Overview
This vulnerability has a similar attack surface as the one described in CVE-2024-55555 where Laravel based applications can be exploited due to bad decryption implementations. In this case, an attacker in possession of the secret Laravel APP_KEY would therefore be able to retrieve the Laravel cookie, uncipher it and modify the serialized data in order to get arbitrary deserialization on the affected server, allowing them to achieve remote command execution. The attack sequence is very well described in this security advisory of Synacktiv.
InvoiceShelf is an example of a Laravel PHP based application where this vulnerability can be abused. InvoiceShelf version 1.3.0 and lower, which is a fork of Crater Invoice, is vulnerable.
As discussed in the related CVE-2024-55555 research, you can use the LaravelCrytpoKiller mixin to exploit this type of vulnerabilities using Metasploit. I created a Metasploit module targeting vulnerable InvoiceShelf applications to automate and demonstrate the attack.
You can find the module in this PR submission InvoiceShelf unauthenticated PHP deserialization vulnerability.
References
- CVE-2024-55556
- Laravel HackTricks
- InvoiceShelf security disclosure from Synacktiv
- InvoiceShelf GitHub
Credits
Rémi Matasse and Mickaël Benassouli from Synacktiv