CVE-2021-33898 Deserialization in n/a
An unsafe unserialize call in Invoice Ninja allows remote code execution if an attacker controls the geoplugin.net response.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33898?
CVE-2021-33898 is a high-severity unsafe deserialization vulnerability in n/a, published on 6 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it.
Weakness: CWE-502
Which versions are affected by CVE-2021-33898?
It affects 1 product.
Products include Invoiceninja Invoice Ninja.
How do I fix CVE-2021-33898?
No fix has been published for CVE-2021-33898 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-33898 being exploited?
There is no known exploitation of CVE-2021-33898 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-29925 Server-side request forgery in n/a
- CVE-2021-3977 Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja
- CVE-2026-33628 Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
- CVE-2026-33742 Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes
- CVE-2017-1000466 Cross-site scripting in n/a
Sources
Also known as GHSA-r5q9-wmfc-68m2.