CVE-2024-12667 Overview
CVE-2024-12667 is a session management vulnerability in InvoicePlane, an open-source invoicing application. The flaw affects versions up to and including 1.6.1 and resides in the /invoices/view endpoint. Improper session expiration handling allows remote attackers to manipulate session state under specific conditions. The vulnerability is classified under CWE-613: Insufficient Session Expiration. While the attack is network-reachable and requires no authentication or user interaction, exploitation complexity is high, limiting practical abuse. The vendor responded quickly and released version 1.6.2-beta-1 to address the issue.
Critical Impact
Remote attackers can potentially manipulate session expiration behavior in the /invoices/view endpoint, undermining session integrity controls in InvoicePlane deployments.
Affected Products
- InvoicePlane versions up to and including 1.6.1
- Self-hosted InvoicePlane installations exposed to untrusted networks
- Deployments that have not upgraded to 1.6.2-beta-1 or later
Discovery Timeline
- 2024-12-16 - CVE-2024-12667 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12667
Vulnerability Analysis
The vulnerability resides in unspecified functionality of the /invoices/view route within InvoicePlane. According to the published advisory, manipulation of this endpoint leads to improper session expiration behavior. An authenticated user's session state can be influenced through network-based requests without prior authentication to the application. The confidentiality impact is limited, with no integrity or availability consequences reported. Exploitation complexity is rated high, meaning an attacker must satisfy specific conditions outside their direct control to succeed. The issue falls under CWE-613, which addresses sessions that remain valid beyond their intended lifetime or whose expiration can be bypassed.
Root Cause
The root cause is insufficient session expiration enforcement in the /invoices/view controller. InvoicePlane does not consistently invalidate or validate session lifetimes when this endpoint is accessed under certain conditions. This weakness permits session state to persist or be influenced beyond expected boundaries, violating the application's intended authentication lifecycle.
Attack Vector
The attack is launched remotely over the network against the InvoicePlane web interface. No privileges or user interaction are required to initiate the request. However, the attacker must align specific preconditions, which raises the practical difficulty. The exploit has been publicly disclosed through VulDB entry #288536, but no weaponized proof-of-concept is currently indexed in major exploit databases.
No verified exploitation code is available for this vulnerability. Refer to the InvoicePlane v1.6.2-beta-1 release notes for the corresponding fix.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-12667
Indicators of Compromise
- Unexpected HTTP requests to /invoices/view originating from unauthenticated or anomalous source IP addresses
- Session identifiers that remain active beyond the configured expiration window
- Repeated access to invoice view endpoints without preceding authentication flows in web server logs
Detection Strategies
- Review web server access logs for repeated or malformed requests targeting /invoices/view
- Correlate session identifier reuse across disparate client fingerprints or IP addresses
- Compare installed InvoicePlane versions against the fixed release 1.6.2-beta-1 during asset inventory scans
Monitoring Recommendations
- Enable verbose session lifecycle logging within the PHP application layer and reverse proxy
- Alert on sessions that persist beyond the configured timeout threshold
- Monitor outbound invoice data access patterns for anomalies that deviate from normal user behavior
How to Mitigate CVE-2024-12667
Immediate Actions Required
- Upgrade all InvoicePlane instances to version 1.6.2-beta-1 or later as published by the vendor
- Audit active sessions and force logout of all users following the upgrade
- Restrict administrative access to the InvoicePlane interface using network-level controls or VPN gating
Patch Information
The vendor has released a corrected version. Deploy InvoicePlane v1.6.2-beta-1 to remediate the session expiration weakness. Additional advisory context is available through the VulDB CTI entry #288536.
Workarounds
- Shorten PHP session lifetime values in php.ini and the InvoicePlane configuration to reduce exposure window
- Place the InvoicePlane application behind an authenticating reverse proxy that enforces independent session timeouts
- Enforce TLS and secure cookie attributes (HttpOnly, Secure, SameSite=Strict) to limit session abuse vectors
# Configuration example: tighten PHP session expiration
# /etc/php/8.x/fpm/php.ini
session.gc_maxlifetime = 900
session.cookie_lifetime = 900
session.cookie_httponly = 1
session.cookie_secure = 1
session.cookie_samesite = "Strict"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
