CVE-2024-55555: Invoice Ninja RCE Vulnerability

CVE-2024-55555 Overview

CVE-2024-55555 is a pre-authenticated remote code execution vulnerability in Invoice Ninja versions before 5.10.43. The flaw resides in the route/{hash} route defined in invoiceninja/routes/client.php, which passes the {hash} parameter directly to Laravel's decrypt function. An attacker who knows the application's APP_KEY can craft a ciphered payload containing a serialized object, triggering insecure deserialization through Laravel gadget chains. The issue is amplified by .env files present in the product's public repository that ship with default APP_KEY values, exposing installations that reuse those defaults.

Critical Impact
Attackers with knowledge of the APP_KEY can achieve unauthenticated remote command execution on vulnerable Invoice Ninja instances, leading to full server compromise. [CWE-502]

Affected Products

Invoice Ninja versions prior to 5.10.43
Installations reusing default APP_KEY values from public .env files
Self-hosted Invoice Ninja deployments exposing the /route/{hash} endpoint

Discovery Timeline

2025-01-07 - CVE-2024-55555 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55555

Vulnerability Analysis

The vulnerability is an insecure deserialization flaw classified under [CWE-502]. Invoice Ninja exposes a public route, route/{hash}, that accepts an attacker-controlled string and passes it to Laravel's decrypt function. Laravel's decrypt verifies the ciphertext's MAC using the application's APP_KEY, then deserializes the decrypted payload with PHP's unserialize. When the attacker controls the APP_KEY, MAC validation succeeds for arbitrary payloads. Laravel bundles multiple gadget chains that can escalate arbitrary deserialization into command execution on the underlying host.

Root Cause

The root cause is twofold. First, the client-side route route/{hash} deserializes attacker-supplied input without authentication, relying solely on encryption for integrity. Second, the project's public repository historically shipped .env files containing default APP_KEY values. Operators who deploy Invoice Ninja without regenerating the APP_KEY grant remote attackers the exact secret needed to forge valid ciphertexts.

Attack Vector

An unauthenticated remote attacker crafts a serialized PHP object using a known Laravel gadget chain. The attacker encrypts the payload with the target's APP_KEY using Laravel's encryption format and submits it as the {hash} path segment to /route/{hash}. The server decrypts the payload, invokes unserialize, and triggers the gadget chain, executing arbitrary commands under the web server user.

php

// Security patch in routes/client.php — the vulnerable route is commented out
    Route::get('unsubscribe/{entity}/{invitation_key}', [App\Http\Controllers\ClientPortal\InvitationController::class, 'unsubscribe'])->name('unsubscribe');
});

// Route::get('route/{hash}', function ($hash) {

//     $route = '/';

//     try {
//         $route = decrypt($hash);
//     }
//     catch (\Exception $e) {
//         abort(404);
//     }

//     return redirect($route);

// })->middleware('throttle:404');

Route::get('phantom/{entity}/{invitation_key}', [Phantom::class, 'displayInvitation'])->middleware(['invite_db', 'phantom_secret'])->name('phantom_view');

Source: Invoice Ninja GitHub Commit d9302021. The patch disables the vulnerable route entirely by commenting it out, eliminating the deserialization sink.

Detection Methods for CVE-2024-55555

Indicators of Compromise

HTTP GET requests to /route/{hash} where {hash} is an unusually long base64-like string, particularly from unexpected external sources.
Presence of a default or committed APP_KEY value in the deployed .env file matching values from the public Invoice Ninja repository.
Web server processes (php-fpm, nginx, apache) spawning unexpected child processes such as sh, bash, curl, wget, or python.
New or modified PHP files under the Invoice Ninja document root outside normal deployment windows.

Detection Strategies

Inspect web server access logs for requests matching the pattern GET /route/* and correlate against source IP reputation and request frequency.
Audit deployed .env files across Invoice Ninja hosts and flag any APP_KEY value that matches known defaults from the public repository.
Monitor PHP process lineage for the web server user executing shell utilities, which indicates successful gadget chain execution.

Monitoring Recommendations

Enable process execution telemetry on hosts running Invoice Ninja and alert on web-tier processes creating outbound network connections or spawning interpreters.
Forward web application logs and OS process telemetry into a centralized SIEM for correlation and long-term retention.
Deploy file integrity monitoring on the Invoice Ninja application directory to detect webshell drops or configuration tampering.

How to Mitigate CVE-2024-55555

Immediate Actions Required

Upgrade Invoice Ninja to version 5.10.43 or later without delay.
Rotate the APP_KEY on every Invoice Ninja instance using php artisan key:generate, assuming the previous value may be exposed.
Verify that no .env file in production matches the default values shipped in the public repository.
Review web server and application logs for prior requests to /route/{hash} to identify possible pre-patch exploitation attempts.

Patch Information

The upstream fix ships in Invoice Ninja 5.10.43 and disables the vulnerable route/{hash} handler in routes/client.php. The change is visible in Invoice Ninja commit d9302021. Additional technical context is available in the Synacktiv Security Advisory.

Workarounds

If patching is not immediately possible, remove or comment out the Route::get('route/{hash}', ...) handler in routes/client.php and clear the route cache.
Restrict external access to Invoice Ninja behind a VPN or IP allowlist until upgrade is complete.
Regenerate the APP_KEY and invalidate any long-lived sessions or encrypted tokens issued under the old key.

bash

# Regenerate the Laravel APP_KEY and clear cached routes and config
php artisan key:generate --force
php artisan route:clear
php artisan config:clear
php artisan cache:clear

# Verify the deployed version is 5.10.43 or later
grep -R "'version'" config/ninja.php