CVE-2024-55556
CriticalSummary
Podatność w Crater Invoice pozwala nieautoryzowanemu atakującemu, który zna APP_KEY, na zdalne wykonanie poleceń na serwerze poprzez manipulację ciasteczkiem laravel_session. Wykorzystanie tej podatności opiera się na uzyskaniu tajnego APP_KEY, co umożliwia deszyfrowanie i manipulację danymi sesji.
Risk Assessment
Ryzyko dla organizacji polega na możliwości zdalnego wykonania poleceń na serwerze, co może prowadzić do poważnych naruszeń bezpieczeństwa i utraty danych. Atakujący, mając dostęp do serwera, może przejąć kontrolę nad systemem.
Recommendation
Zaleca się zabezpieczenie APP_KEY oraz monitorowanie dostępu do ciasteczek sesyjnych. Należy również wdrożyć dodatkowe mechanizmy zabezpieczeń, takie jak ograniczenie dostępu do aplikacji oraz regularne aktualizacje oprogramowania.
Related vulnerabilities
- CVE-2026-82688Critical
D-Link DNS-340L and DNS-345 (versions 1.01B04/1.03B06/1.04.B02/1.05b04) have a vulnerability in /cgi-bin/virtual_vol.cgi (Virtual Volume Handler). Manipulation of arguments f_sharename/f_target/f_name leads to OS command injection. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-49003Critical
Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash. They can also gain root privileges to steal configuration passwords (e.g., SNMP) and tamper with critical system parameters, leading to abnormal operation of the entire power system.
- CVE-2026-82874Critical
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose schemas, plant malicious tables, corrupt schemas, or permanently destroy data.
- CVE-2026-82872Critical
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.
- CVE-2026-82870Critical
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.
- CVE-2026-82860Critical
@hulumi/policies before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
- CVE-2026-82859Critical
hulumi before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.
- CVE-2026-82858Critical
@hulumi/drift before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.
- CVE-2026-82857Critical
A privilege escalation vulnerability in hulumi before v1.3.2 exists in the weekly integration IAM policy, allowing role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.
- CVE-2026-82856Critical
A vulnerability in @hulumi/policies before 1.3.2 fails to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.
Original NVD description (English source)
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this vulnerability relies on an attacker obtaining Laravel's secret APP_KEY, which would allow them to decrypt and manipulate session cookies (laravel_session) containing serialized data. By altering this data and re-encrypting it with the APP_KEY, the attacker could trigger arbitrary deserialization on the server, potentially leading to remote command execution (RCE). The vulnerability is primarily exploited by accessing an exposed cookie and manipulating it using the secret key to gain malicious access to the server.