inventree

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).

By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.

Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users

Solution

The solution here is two-fold:

• Enable data sanitization for the EasyMDE renderer - #3205
• Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release)

Patches

• The issue is addressed in the 0.8.0 release
• This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release

Workarounds

There is no workaround for this issue without upgrading InvenTree to the specified version.

References

• https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

Impact

InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files (such as HTML files containing malicious javascript) can be uploaded, and (when opened by the user) run the malicious code directly in the users browser.

Note that the upload of malicious files must be performed by an authenticated user account

Solution

The solution for this vulnerability is to ensure that attachment files are downloaded to the local machine before opening, rather than opening the file in the current browser context.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users can alleviate risk of opening malicious files by right-clicking on the attachment link and selecting "Save link as"

This minimizes risk (e.g. of XSS attacks) by opening the HTML file from the users computer

References

https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).

By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.

Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users

Solution

The solution here is two-fold:

• Enable data sanitization for the EasyMDE renderer - #3205
• Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release)

Patches

• The issue is addressed in the 0.8.0 release
• This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release

Workarounds

There is no workaround for this issue without upgrading InvenTree to the specified version.

References

• https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

References

• https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/
• https://owasp.org/www-community/attacks/CSV_Injection

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views.

The problem here stems from multiple issues:

• Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML
• Lack of HTML escaping when rendering data on the front end

The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree development team takes seriously.

Solution

The proposed patch for this vulnerability is prevents injection of un-escaped fields into front-end UI elements.

A future patch will also address sanitization of database fields on the "back end", however this will require a much larger effort to refactor multiple database tables.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

There are no workarounds for this issue, users should upgrade to a patched version.

References

• https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57/
• https://huntr.dev/bounties/9d640ef2-c52c-4106-b043-f7497d577078/
• https://huntr.dev/bounties/b114e82f-6c02-485b-82ea-e242f89169c2/
• https://huntr.dev/bounties/22783cd3-1b2c-48fc-b31f-03b53c86da0b/

Thank you @saharshtapi for bringing this issue to our attention and giving pointers for fixing them.

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

Impact

InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files (such as HTML files containing malicious javascript) can be uploaded, and (when opened by the user) run the malicious code directly in the users browser.

Note that the upload of malicious files must be performed by an authenticated user account

Solution

The solution for this vulnerability is to ensure that attachment files are downloaded to the local machine before opening, rather than opening the file in the current browser context.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users can alleviate risk of opening malicious files by right-clicking on the attachment link and selecting "Save link as"

This minimizes risk (e.g. of XSS attacks) by opening the HTML file from the users computer

References

https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).

By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.

Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users

Solution

The solution here is two-fold:

• Enable data sanitization for the EasyMDE renderer - #3205
• Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release)

Patches

• The issue is addressed in the 0.8.0 release
• This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release

Workarounds

There is no workaround for this issue without upgrading InvenTree to the specified version.

References

• https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

References

• https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/
• https://owasp.org/www-community/attacks/CSV_Injection

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views.

The problem here stems from multiple issues:

• Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML
• Lack of HTML escaping when rendering data on the front end

The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree development team takes seriously.

Solution

The proposed patch for this vulnerability is prevents injection of un-escaped fields into front-end UI elements.

A future patch will also address sanitization of database fields on the "back end", however this will require a much larger effort to refactor multiple database tables.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

There are no workarounds for this issue, users should upgrade to a patched version.

References

• https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57/
• https://huntr.dev/bounties/9d640ef2-c52c-4106-b043-f7497d577078/
• https://huntr.dev/bounties/b114e82f-6c02-485b-82ea-e242f89169c2/
• https://huntr.dev/bounties/22783cd3-1b2c-48fc-b31f-03b53c86da0b/

Thank you @saharshtapi for bringing this issue to our attention and giving pointers for fixing them.

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

Impact

InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files (such as HTML files containing malicious javascript) can be uploaded, and (when opened by the user) run the malicious code directly in the users browser.

Note that the upload of malicious files must be performed by an authenticated user account

Solution

The solution for this vulnerability is to ensure that attachment files are downloaded to the local machine before opening, rather than opening the file in the current browser context.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users can alleviate risk of opening malicious files by right-clicking on the attachment link and selecting "Save link as"

This minimizes risk (e.g. of XSS attacks) by opening the HTML file from the users computer

References

https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).

By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.

Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users

Solution

The solution here is two-fold:

• Enable data sanitization for the EasyMDE renderer - #3205
• Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release)

Patches

• The issue is addressed in the 0.8.0 release
• This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release

Workarounds

There is no workaround for this issue without upgrading InvenTree to the specified version.

References

• https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

References

• https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/
• https://owasp.org/www-community/attacks/CSV_Injection

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views.

The problem here stems from multiple issues:

• Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML
• Lack of HTML escaping when rendering data on the front end

The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree development team takes seriously.

Solution

The proposed patch for this vulnerability is prevents injection of un-escaped fields into front-end UI elements.

A future patch will also address sanitization of database fields on the "back end", however this will require a much larger effort to refactor multiple database tables.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

There are no workarounds for this issue, users should upgrade to a patched version.

References

• https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57/
• https://huntr.dev/bounties/9d640ef2-c52c-4106-b043-f7497d577078/
• https://huntr.dev/bounties/b114e82f-6c02-485b-82ea-e242f89169c2/
• https://huntr.dev/bounties/22783cd3-1b2c-48fc-b31f-03b53c86da0b/

Thank you @saharshtapi for bringing this issue to our attention and giving pointers for fixing them.

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

Impact

InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files (such as HTML files containing malicious javascript) can be uploaded, and (when opened by the user) run the malicious code directly in the users browser.

Note that the upload of malicious files must be performed by an authenticated user account

Solution

The solution for this vulnerability is to ensure that attachment files are downloaded to the local machine before opening, rather than opening the file in the current browser context.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users can alleviate risk of opening malicious files by right-clicking on the attachment link and selecting "Save link as"

This minimizes risk (e.g. of XSS attacks) by opening the HTML file from the users computer

References

https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

Impact

InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).

By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.

Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users

Solution

The solution here is two-fold:

• Enable data sanitization for the EasyMDE renderer - #3205
• Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release)

Patches

• The issue is addressed in the 0.8.0 release
• This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release

Workarounds

There is no workaround for this issue without upgrading InvenTree to the specified version.

References

• https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

References

• https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/
• https://owasp.org/www-community/attacks/CSV_Injection

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views.

The problem here stems from multiple issues:

• Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML
• Lack of HTML escaping when rendering data on the front end

The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree development team takes seriously.

Solution

The proposed patch for this vulnerability is prevents injection of un-escaped fields into front-end UI elements.

A future patch will also address sanitization of database fields on the "back end", however this will require a much larger effort to refactor multiple database tables.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

There are no workarounds for this issue, users should upgrade to a patched version.

References

• https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57/
• https://huntr.dev/bounties/9d640ef2-c52c-4106-b043-f7497d577078/
• https://huntr.dev/bounties/b114e82f-6c02-485b-82ea-e242f89169c2/
• https://huntr.dev/bounties/22783cd3-1b2c-48fc-b31f-03b53c86da0b/

Thank you @saharshtapi for bringing this issue to our attention and giving pointers for fixing them.

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

Impact

InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files (such as HTML files containing malicious javascript) can be uploaded, and (when opened by the user) run the malicious code directly in the users browser.

Note that the upload of malicious files must be performed by an authenticated user account

Solution

The solution for this vulnerability is to ensure that attachment files are downloaded to the local machine before opening, rather than opening the file in the current browser context.

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users can alleviate risk of opening malicious files by right-clicking on the attachment link and selecting "Save link as"

This minimizes risk (e.g. of XSS attacks) by opening the HTML file from the users computer

References

https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1/

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at security@inventree.org

Impact

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Patches

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.