InvoicePlane File Upload Vulnerability Allowing Remote Code Execution

A file upload vulnerability has been identified in InvoicePlane versions through 1.6.3. This vulnerability allows authenticated users to upload arbitrary PHP files via the attachment feature. Once uploaded, these files can be executed remotely, leading to remote code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where InvoicePlane is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user can upload a PHP file through the attachment upload functionality. The upload handler performs a partial MIME type check, but it is possible to bypass this by declaring a benign MIME type such as text/plain. Once the PHP file is uploaded, it can be accessed and executed on the server, allowing for arbitrary code execution in the context of the web application.

Remediation

Users can update to InvoicePlane version 1.6.4 to address this vulnerability.