SugarCRM 6.5.18 fopen() Command Injection / XSS / SSRF

2016.06.24
Credit: Egidio Romano
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79
CWE-78

----------------------------------------------------------------------------- SugarCRM <= 6.5.18 (MySugar::addDashlet) Insecure fopen() Usage Vulnerability ----------------------------------------------------------------------------- [-] Software Link: http://www.sugarcrm.com/ [-] Affected Versions: Version 6.5.18 CE and other versions. [-] Vulnerability Description: The vulnerable code is located within the MySugar::addDashlet() method: 89. if (isset($_REQUEST['type']) && $_REQUEST['type'] == 'web') { 90. $dashlet_module = 'Home'; 91. require_once('include/Dashlets/DashletRssFeedTitle.php'); 92. $options['url'] = $_REQUEST['type_module']; 93. $webDashlet = new DashletRssFeedTitle($options['url']); 94. $options['title'] = $webDashlet->generateTitle(); User input passed through the "type_module" request parameter isn?t properly sanitized before being used to instantiate a new DashletRssFeedTitle object, and this could be exploited to carry out certain attacks because of the DashletRssFeedTitle::readFeed() method (user input passed directly to the "fopen()" function): 71. public function readFeed() { 72. if ($this->url) { 73. $fileOpen = @fopen($this->url, 'r'); 74. if ($fileOpen) { 75. $this->fileOpen = true; 76. $this->contents = fread($fileOpen, $this->readBytes); 77. fclose($fileOpen); 78. return true; 79. } This can be exploited by authenticated attackers to carry out Server-Side Request Forgery (SSRF) attacks, potentially read content of arbitrary files, initiate a Cross-Site Scripting (XSS) attack, or execute arbitrary OS commands when the "expect" extension is installed through the following URL: http://[host]/[sugar]/index.php?module=Home&action=DynamicAction&DynamicAction=addDashlet&id=1&type=web&type_module=expect://[cmd] [-] Solution: Update to version 6.5.19 CE or higher to partially mitigate the vulnerability. No official solution is currently available against the SSRF and XSS attack vectors. [-] Disclosure Timeline: [15/10/2014] - Vendor notified [15/12/2014] - Version 6.5.19 CE released: http://bit.do/sugar6519 [29/04/2015] - CVE number requested [23/06/2016] - Public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a CVE identifier for this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: http://karmainsecurity.com/KIS-2016-06

References:

http://karmainsecurity.com/KIS-2016-06


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top