Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user. This error message may contain sensitive information about the server side request, including information about the availability of the remote resource. Patches The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client. This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release. Workarounds To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information. References Thanks to @febin0x10 for identifying this vulnerability and reporting it…
Recommended action: Upgrade to 0.16.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.
Recommended action: Upgrade to 0.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
Recommended action: Upgrade to 0.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models). By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser. Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users Solution The solution here is two-fold: - Enable data sanitization for the EasyMDE renderer - #3205 - Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release) Patches - The issue is addressed in the 0.8.0 release - This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release Workarounds There is no workaround for this issue without upgrading InvenTree to the specified version. References - https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/ For more information…
Recommended action: Upgrade to 0.7.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection Patches - The issue is addressed in the upcoming 0.8.0 release - This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release Workarounds Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel). References - https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/ - https://owasp.org/www-community/attacks/CSVInjection For more information If you have any questions or comments about this advisory: Open an issue in github Email us at security@inventree.org
Recommended action: Upgrade to 0.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files (such as HTML files containing malicious javascript) can be uploaded, and (when opened by the user) run the malicious code directly in the users browser. Note that the upload of malicious files must be performed by an authenticated user account Solution The solution for this vulnerability is to ensure that attachment files are downloaded to the local machine before opening, rather than opening the file in the current browser context. Patches - The issue is addressed in the upcoming 0.8.0 release - This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release Workarounds Users can alleviate risk of opening malicious files by right-clicking on the attachment link and selecting "Save link as" This minimizes risk (e.g. of XSS attacks) by opening the HTML file from the users computer References…
Recommended action: Upgrade to 0.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views. The problem here stems from multiple issues: - Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML - Lack of HTML escaping when rendering data on the front end The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree development team takes seriously. Solution The proposed patch for this vulnerability is prevents injection of un-escaped fields into front-end UI elements. A future patch will also address sanitization of database fields on the "back end", however this will require a much larger effort to refactor multiple database tables. Patches - The issue is…
Recommended action: Upgrade to 0.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.