CVE-2024-55556

Crater Invoice, a self-hosted Laravel-based invoicing application, contains a deserialization flaw (CWE-502) that allows an unauthenticated attacker to achieve remote command execution. The attack requires knowledge of the application's Laravel APP_KEY: with it, the attacker can decrypt the laravel_session cookie, alter the serialized data inside it, re-encrypt the value, and send it back, causing the server to deserialize attacker-controlled data and execute commands. Successful exploitation yields full remote command execution on the host, consistent with the critical 9.8 CVSS score covering confidentiality, integrity, and availability. Any internet-reachable Crater instance whose APP_KEY is known, guessed, or leaked is exposed; related reporting indicates over 600 Laravel apps have leaked APP_KEYs committed on GitHub. No public proof-of-concept or confirmed in-the-wild exploitation is known, but EPSS assigns a 44.1% probability of exploitation within 30 days, so preemptive mitigation is warranted.

What to do: Check whether your Crater deployment's APP_KEY has ever been committed to a repository or otherwise disclosed, and rotate it if so, noting that rotation invalidates existing sessions. Limit internet exposure of the instance (restrict access or place it behind a VPN/reverse proxy with access controls) until patched, and apply the vendor's update as soon as a fixed release is published, since no fixed version is specified in the available data.