CVE-2024-30162: Invision Community RCE Vulnerability

CVE-2024-30162 Overview

Invision Community through version 4.7.16 contains a critical remote code execution vulnerability in the editor toolbar plugin upload functionality. The vulnerability exists in applications/core/modules/admin/editor/toolbar.php within the IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method processes uploaded ZIP files and extracts them into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly validating the contents of the archive. An authenticated administrator with the toolbar_manage permission can exploit this flaw to upload malicious PHP files, achieving arbitrary code execution in the context of the web server user.

Critical Impact

Authenticated administrators can achieve remote code execution by uploading a malicious ZIP file containing PHP code, potentially leading to complete server compromise.

Affected Products

• Invision Community versions up to and including 4.7.16
• Invision Community installations with the CKEditor plugin upload functionality enabled
• Any deployment where admin users have the toolbar_manage permission

Discovery Timeline

• 2024-06-07 - CVE-2024-30162 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-30162

Vulnerability Analysis

The vulnerability is classified under CWE-345 (Insufficient Verification of Data Authenticity), indicating that the application fails to properly verify the legitimacy and safety of uploaded content before processing it. The addPlugin() method in the toolbar module is designed to allow administrators to extend CKEditor functionality by uploading plugin ZIP archives. However, the implementation lacks adequate content validation, creating a dangerous attack surface.

When an administrator uploads a ZIP file through the toolbar management interface, the application extracts all contents directly to the plugins directory without checking for malicious file types such as PHP scripts. Since the extraction destination is within the web-accessible directory structure, any PHP files included in the malicious archive become immediately executable via HTTP requests.

Root Cause

The root cause of this vulnerability is the absence of file type validation during the ZIP extraction process. The addPlugin() method trusts the contents of uploaded archives implicitly, extracting all files regardless of their extensions or potential for code execution. This violates the principle of defense in depth, as the application should validate both the archive structure and the individual files contained within before allowing extraction to a web-accessible location.

Attack Vector

Exploitation requires an attacker to have administrative access with the toolbar_manage permission in the Invision Community installation. The attack proceeds as follows:

1. The attacker crafts a malicious ZIP file containing a PHP webshell or backdoor script
2. Using the toolbar management interface, the attacker uploads the ZIP as a "CKEditor plugin"
3. The application extracts the contents to applications/core/interface/ckeditor/ckeditor/plugins/[plugin_name]/
4. The attacker accesses the malicious PHP file directly via HTTP, executing arbitrary commands

This vulnerability enables authenticated privilege escalation from web application administrator to operating system-level code execution. The requirement for administrative access limits the attack surface, but organizations should note that compromised admin credentials or insider threats could leverage this vulnerability for persistent access and lateral movement.

Detection Methods for CVE-2024-30162

Indicators of Compromise

• Presence of unexpected PHP files in the applications/core/interface/ckeditor/ckeditor/plugins/ directory
• Recently created or modified files with .php extensions in CKEditor plugin directories
• Web server access logs showing requests to PHP files within the CKEditor plugins path
• Unusual outbound network connections or command execution originating from the web server process

Detection Strategies

• Implement file integrity monitoring (FIM) on the CKEditor plugins directory to detect unauthorized file additions
• Configure web application firewalls (WAF) to alert on PHP file access within plugin directories
• Review admin activity logs for toolbar plugin uploads, especially from new or suspicious IP addresses
• Deploy endpoint detection and response (EDR) solutions to monitor for webshell-like behavior patterns

Monitoring Recommendations

• Enable comprehensive audit logging for all administrative actions in Invision Community
• Monitor the toolbar_manage permission grants and review which users have this capability
• Implement real-time alerting for new file creation events in web-accessible directories
• Regularly scan plugin directories for files with executable extensions

How to Mitigate CVE-2024-30162

Immediate Actions Required

• Upgrade Invision Community to the latest version that addresses this vulnerability
• Audit the applications/core/interface/ckeditor/ckeditor/plugins/ directory for any unauthorized PHP files
• Review which administrator accounts have the toolbar_manage permission and restrict access where possible
• Implement additional access controls for administrative functions pending patch deployment

Patch Information

Invision Community users should check the Invision Community Security Resource for the latest security updates and patch information. Additional technical details about the vulnerability disclosure can be found in the Full Disclosure Mailing List Post.

Organizations should prioritize patching this vulnerability given the potential for remote code execution. Network-accessible administrative interfaces should be protected with additional controls such as IP whitelisting or VPN requirements.

Workarounds

• Restrict the toolbar_manage permission to only essential trusted administrators
• Implement web server configuration to deny execution of PHP files within the CKEditor plugins directory
• Deploy a web application firewall rule to block ZIP file uploads to the toolbar management endpoint
• Consider temporarily disabling the plugin upload functionality if not actively required

# Apache configuration to prevent PHP execution in CKEditor plugins directory
<Directory "/path/to/invision/applications/core/interface/ckeditor/ckeditor/plugins">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>