CVE-2022-2111: Unrestricted File Upload in inventree/inventree
CVE ID: CVE-2022-2111
Date: June 17, 2022
Severity: High (CVSS 3.1: 8.8)
CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type
Affected: inventree/inventree prior to 0.7.2
Fixed in: 0.7.2
🔍 Overview
InvenTree prior to 0.7.2 allows unrestricted upload of files with dangerous types. An attacker with low privileges can upload arbitrary files (including executable or script files) to the server, potentially leading to remote code execution or complete server compromise.
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector: Network, low complexity, low privileges, no user interaction required, unchanged scope.
🎯 Impact
This is a high-severity issue because no user interaction is required. An authenticated low-privilege user can:
- Upload web shells or malicious scripts to the server
- Achieve remote code execution in the context of the application
- Gain full confidentiality, integrity, and availability compromise of the host
🛡️ Mitigation
Upgrade to InvenTree 0.7.2 or later. Implement strict file upload controls:
- Validate file extensions and MIME types against an allowlist
- Store uploaded files outside the web root with non-executable permissions
- Scan uploads for malware
- Use a dedicated, isolated storage service for user-supplied files