CVE-2024-12478: InvoicePlane Unrestricted Upload Vulnerability

CVE-2024-12478 Overview

A vulnerability in InvoicePlane through version 1.6.1 allows unrestricted file upload through the upload_file function in /index.php/upload/upload_file/1/1. Attackers manipulate the file parameter to upload arbitrary files to the server. The vulnerability requires low-privileged network access and no user interaction. Public disclosure of the exploit details has occurred, increasing the risk of opportunistic attacks against exposed InvoicePlane instances. The issue is categorized as [CWE-284] Improper Access Control. The vendor released version 1.6.2-beta-1 to address the flaw.

Critical Impact
Authenticated remote attackers can upload arbitrary files to InvoicePlane servers, potentially leading to server compromise, malware hosting, and integrity loss of the invoicing application.

Affected Products

InvoicePlane versions up to and including 1.6.1
InvoicePlane self-hosted deployments exposing the /index.php/upload/upload_file/ endpoint
Fixed in InvoicePlane 1.6.2-beta-1

Discovery Timeline

2024-12-16 - CVE-2024-12478 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12478

Vulnerability Analysis

InvoicePlane is an open-source PHP-based invoicing application widely deployed for small business billing. The vulnerability exists in the upload_file function responsible for processing file uploads through the upload controller. The endpoint /index.php/upload/upload_file/1/1 accepts the file argument without enforcing restrictions on file type, extension, or content. Attackers submit crafted requests containing executable server-side scripts or other unauthorized file formats. The application stores the uploaded content in a location accessible to the web server, expanding the impact beyond simple data ingestion.

Root Cause

The root cause is improper access control combined with missing upload validation in the upload_file handler. The function does not enforce a whitelist of permitted MIME types or file extensions before writing the uploaded content to disk. Authorization checks around the endpoint are insufficient to prevent abuse by users holding low-privilege accounts.

Attack Vector

Exploitation requires network access to the InvoicePlane instance and a low-privileged authenticated session. The attacker sends an HTTP POST request to /index.php/upload/upload_file/1/1 with a manipulated file parameter containing arbitrary content. The absence of server-side type enforcement allows the payload to reach the filesystem. Public exploit information has been disclosed, lowering the barrier to reproduction. Refer to the GitHub Pull Request #1141 and VulDB entry #288538 for additional technical background.

Detection Methods for CVE-2024-12478

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) within InvoicePlane upload directories
HTTP POST requests targeting /index.php/upload/upload_file/1/1 with non-standard MIME types
Web server access logs showing subsequent GET requests to unusual filenames under upload paths
Outbound connections from the InvoicePlane host to unknown external infrastructure following file upload activity

Detection Strategies

Inspect web application logs for POST requests to the vulnerable upload endpoint originating from low-privileged accounts
Monitor the InvoicePlane upload directory for newly created files with server-executable extensions
Correlate authentication events with upload activity to identify abnormal upload volumes per user
Deploy file integrity monitoring on the InvoicePlane application root to identify unauthorized file creation

Monitoring Recommendations

Enable verbose HTTP request logging on the web server hosting InvoicePlane, capturing full request bodies where feasible
Ingest web server and application logs into a centralized analytics platform for correlation and retention
Alert on process execution originating from the InvoicePlane upload directory, indicating post-upload code execution
Track outbound network activity from the InvoicePlane host to identify command-and-control communication

How to Mitigate CVE-2024-12478

Immediate Actions Required

Upgrade InvoicePlane to version 1.6.2-beta-1 or later as released by the vendor
Audit the InvoicePlane upload directory for unauthorized files created before patching
Rotate application credentials and API tokens if unauthorized upload activity is confirmed
Restrict network exposure of the InvoicePlane administrative interface to trusted networks or VPN users

Patch Information

The vendor addressed the flaw in the InvoicePlane v1.6.2-beta-1 release. The fix is documented in Pull Request #1141, which introduces validation on the upload_file handler. Administrators running any version up to 1.6.1 should apply the update promptly.

Workarounds

Block or restrict access to /index.php/upload/upload_file/ at the reverse proxy or web application firewall level until patching is complete
Configure the web server to deny execution of scripts within the InvoicePlane upload directory using Options -ExecCGI or equivalent directives
Remove write permissions from the upload directory for the web server process where operationally feasible
Limit InvoicePlane user accounts to trusted personnel and disable unused low-privilege accounts

bash

# Example Apache configuration to disable script execution in InvoicePlane uploads directory
<Directory "/var/www/invoiceplane/uploads">
    php_flag engine off
    Options -ExecCGI
    AddType text/plain .php .phtml .phar
</Directory>