Invision Community up to 4.7.16 toolbar.php _toolbar::addPlugin privilege escalation

Summaryinfo

A vulnerability described as critical has been identified in Invision Community up to 4.7.16. The impacted element is the function _toolbar::addPlugin of the file /applications/core/modules/admin/editor/toolbar.php. Executing a manipulation can lead to privilege escalation. This vulnerability appears as CVE-2024-30162. The attack may be performed from remote. In addition, an exploit is available.

Detailsinfo

A vulnerability has been found in Invision Community up to 4.7.16 and classified as critical. This vulnerability affects the function _toolbar::addPlugin of the file /applications/core/modules/admin/editor/toolbar.php. The manipulation with an unknown input leads to a privilege escalation vulnerability. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.

The weakness was presented by Egidio Romano. The advisory is shared for download at ssd-disclosure.com. This vulnerability was named CVE-2024-30162. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are necessary for exploitation. Technical details and also a public exploit are known.

It is possible to download the exploit at karmainsecurity.com. It is declared as proof-of-concept. By approaching the search of inurl:applications/core/modules/admin/editor/toolbar.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Invision Community

Version

• 4.7.0
• 4.7.1
• 4.7.2
• 4.7.3
• 4.7.4
• 4.7.5
• 4.7.6
• 4.7.7
• 4.7.8
• 4.7.9
• 4.7.10
• 4.7.11
• 4.7.12
• 4.7.13
• 4.7.14
• 4.7.15
• 4.7.16

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion