CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values. The route/{hash} route defined in the invoiceninja/routes/client.php file can be accessed without authentication. The parameter {hash} is passed to the function decrypt that expects a Laravel ciphered value containing a serialized object. (Furthermore, Laravel contains several gadget chains usable to trigger remote command execution from arbitrary deserialization.) Therefore, an attacker in possession of the APP_KEY is able to fully control a string passed to an unserialize function.

• CWE-502

• https://github.com/invoiceninja/invoiceninja/commit/d9302021472c3e7e23bac8c3d5fbec57a5f38f0c
• https://www.synacktiv.com/advisories/invoiceninja-unauthenticated-remote-command-execution-when-appkey-known

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55549xsltGetInheritedNsList in libxslt before 1.1.43 has a use-af…7.8
• CVE-2024-5555The Element Pack Elementor Addons (Header Footer, Template L…6.4
• CVE-2024-55550Mitel MiCollab through 9.8 SP2 could allow an authenticated …2.7
• CVE-2024-55551An issue was discovered in Exasol JDBC driver before 24.2.1 …8.3
• CVE-2024-55553In FRRouting (FRR) before 10.3 from 6.0 onward, all routes a…7.5
• CVE-2024-55554Intrexx Portal Server before 12.0.2 allows XSS via a user-de…5.4
• CVE-2024-55556A vulnerability in Crater Invoice allows an unauthenticated …9.8
• CVE-2024-55557ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 ha…9.8
• CVE-2024-5556Zohocorp ManageEngine ADAudit Plus versions below 8000 are v…8.8
• CVE-2024-55560MailCleaner before 28d913e has default values of ssh_host_ds…9.8
• CVE-2024-55563Bitcoin Core through 27.2 allows transaction-relay jamming v…5.3
• CVE-2024-55564The POSIX::2008 package before 0.24 for Perl has a potential…9.8