جزئیات آسیب‌پذیری

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0.

• https://github.com/InvoiceShelf/InvoiceShelf/pull/661 x_refsource_MISC
• https://github.com/InvoiceShelf/InvoiceShelf/commit/e432e4e62f5aa52238e3ff3fc37a0c78588eec47 x_refsource_MISC
• https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 x_refsource_MISC
• https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-j2vg-rxqr-5vc9 x_refsource_CONFIRM