InvoicePlane 1.7.1 Critical Code Execution Flaw: Detection and Remediation Guide for Self-Hosted Billing Servers

---
title: Web Server Process Spawning Shell or Script Interpreter
tech_id: ''
id: 8f2a4b71-3c9d-4e56-a1b2-7d8e9f0a1b2c
status: experimental
description: Detects PHP-FPM, Apache, or Nginx worker processes spawning shells or command interpreters, consistent with post-exploitation of a PHP web application RCE such as the InvoicePlane 1.7.1 code execution flaw.
references:
  - https://www.exploit-db.com/exploits/52685
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate invoicing or backup plugins invoking system tools (rare; investigate rather than suppress broadly)
level: high
---
title: PHP File Created in InvoicePlane Upload or Asset Directories
id: 3b7c9d12-5e8f-4a6b-9c1d-2e3f4a5b6c7d
status: experimental
description: Detects creation of PHP files in InvoicePlane upload, asset, or temp directories. These paths should never contain executable PHP; presence indicates a dropped web shell.
references:
  - https://www.exploit-db.com/exploits/52685
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/invoiceplane/uploads/'
      - '/invoiceplane/assets/'
      - '/ip/uploads/'
      - '/uploads/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate InvoicePlane customization placing templates in upload paths (uncommon; validate against change records)
level: critical
---
title: Suspicious HTTP Request Patterns Against InvoicePlane Application
id: 5d1e7f23-8a4b-4c6d-b2e9-0f1a2b3c4d5e
status: experimental
description: Detects HTTP requests to InvoicePlane containing command execution artifacts in the URI or common web shell access patterns, indicating active exploitation or post-exploitation access.
references:
  - https://www.exploit-db.com/exploits/52685
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - 'invoiceplane'
      - '/index.php/'
  selection_payload:
    cs-uri|contains:
      - 'cmd='
      - 'exec='
      - 'system('
      - 'shell_exec'
      - 'passthru'
      - 'base64_decode'
      - '%3B'  # encoded semicolon for command chaining
      - '|id'
      - '%7Cid'
  condition: selection_uri and selection_payload
falsepositives:
  - Vulnerability scanners and authorized penetration tests
level: high

// Hunt 1: Web server / PHP-FPM spawning command interpreters (Linux via Syslog or Defender for Endpoint on Linux)
let WebParents = dynamic(["php-fpm", "apache2", "httpd", "nginx", "php"]);
let SuspiciousChildren = dynamic(["sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "base64", "id", "whoami"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where InitiatingProcessFileName in~ (WebParents)
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated=TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath),
    (Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has_any ("php-fpm", "apache2")
    | where SyslogMessage has_any ("sh -c", "bash -c", "curl ", "wget ", "base64 -d")
    | project TimeGenerated, Computer, SyslogMessage)
| order by TimeGenerated desc;

// Hunt 2: HTTP requests hitting InvoicePlane with code-execution artifacts (CEF/W3C web logs via CommonSecurityLog)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any ("invoiceplane", "/index.php/")
| where RequestURL has_any ("cmd=", "exec=", "system(", "shell_exec", "passthru", "base64_decode", "%3B", "%7Cid")
| summarize RequestCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, RequestURL, DestinationHostName
| order by RequestCount desc;

// Hunt 3: Network connections FROM the InvoicePlane host to rare external destinations (egress beaconing post-compromise)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("php-fpm", "apache2", "httpd", "sh", "bash", "curl", "wget")
| where RemoteIPType == "Public"
| summarize ConnectionCount=count(), RemoteIPs=make_set(RemoteIP, 20), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName
| order by ConnectionCount asc;

-- InvoicePlane post-exploitation sweep: web shells in upload paths + web server child processes
SELECT * FROM foreach(
  row={
    SELECT "WebShellFiles" AS HuntSection
    FROM glob(globs=[
      '/var/www/**/uploads/**/*.php',
      '/var/www/**/uploads/**/*.phtml',
      '/var/www/**/assets/**/*.php',
      '/srv/www/**/uploads/**/*.php'
    ])
  },
  query={
    SELECT HuntSection, FullPath, Size, Mtime
    FROM glob(globs=FullPath)
  })
UNION ALL
SELECT "WebServerChildProc" AS HuntSection,
       str(str=CommandLine) AS FullPath,
       Pid AS Size,
       timestamp(epoch=CreateTime) AS Mtime
FROM pslist()
WHERE CommandLine =~ 'sh -c|bash -c|curl |wget |base64 -d|nc -e|/dev/tcp/'

#!/bin/bash
# InvoicePlane 1.7.1 RCE - verification and triage script (run as root)

IP_ROOT="${1:-/var/www/html}"
echo "=== InvoicePlane Triage: scanning $IP_ROOT ==="

# 1. Locate InvoicePlane installations and check version
echo "--- [1] Installed version check ---"
find /var/www /srv/www /home -maxdepth 4 -name "ipconfig.php" 2>/dev/null | while read -r cfg; do
  dir=$(dirname "$cfg")
  ver=$(grep -r "IP_VERSION" "$dir/index.php" 2>/dev/null | head -1)
  echo "FOUND: $dir  ($ver)"
  echo "$ver" | grep -q "1.7.1" && echo "  [!] VULNERABLE VERSION 1.7.1 DETECTED"
done

# 2. Sweep for web shells in upload/asset directories
echo "--- [2] PHP files in upload/asset paths (should be empty) ---"
find "$IP_ROOT" -type d \( -name "uploads" -o -name "assets" -o -name "temp" \) 2>/dev/null | while read -r d; do
  find "$d" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -newermt "2025-01-01" -exec ls -la {} \;
done

# 3. Check for exposed setup directory (must be removed post-install)
echo "--- [3] Exposed setup directory check ---"
find /var/www /srv/www -maxdepth 4 -type d -name "setup" 2>/dev/null | grep -i invoice && echo "  [!] SETUP DIRECTORY EXPOSED - DELETE IT"

# 4. Recent suspicious processes parented by web server (from audit log if present)
echo "--- [4] Web server child process audit ---"
ausearch -k execve -ts recent 2>/dev/null | grep -E "php-fpm|apache2|httpd" | grep -E "\/bin\/(sh|bash)|curl|wget" | head -20 || echo "auditd not configured - recommend enabling execve auditing"

# 5. Block PHP execution in uploads via .htaccess (Apache hardening workaround)
echo "--- [5] Applying PHP execution block in uploads (Apache) ---"
for d in $(find "$IP_ROOT" -type d -name "uploads" 2>/dev/null); do
  cat > "$d/.htaccess" <<'EOF'
<FilesMatch "\.(php|phtml|phar|php5)$">
  Require all denied
</FilesMatch>
EOF
  echo "Hardened: $d/.htaccess"
done

echo "=== Triage complete. Review findings above before returning host to service. ==="