what you don't know can hurt you

EspoCRM 2.5.2 XSS / LFI / Access Control

EspoCRM 2.5.2 XSS / LFI / Access Control
Posted Oct 29, 2014
Authored by High-Tech Bridge SA | Site htbridge.com

EspoCRM version 2.5.2 suffers from cross site scripting, local file inclusion, and improper access control vulnerabilities.

tags | exploit, local, vulnerability, xss, file inclusion
advisories | CVE-2014-7985, CVE-2014-7986, CVE-2014-7987
MD5 | 6d3526d415f07821621503e79ba586d0

EspoCRM 2.5.2 XSS / LFI / Access Control

Change Mirror Download
Advisory ID: HTB23238
Product: EspoCRM
Vendor: http://www.espocrm.com
Vulnerable Version(s): 2.5.2 and probably prior
Tested Version: 2.5.2
Advisory Publication: October 8, 2014 [without technical details]
Vendor Notification: October 8, 2014
Vendor Patch: October 10, 2014
Public Disclosure: October 29, 2014
Vulnerability Type: PHP File Inclusion [CWE-98], Improper Access Control [CWE-284], Cross-Site Scripting [CWE-79]
CVE References: CVE-2014-7985, CVE-2014-7986, CVE-2014-7987
Risk Level: High
CVSSv2 Base Scores: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C), 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P), 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple high-risk vulnerabilities in EspoCRM, which can be exploited by remote attacker to execute arbitrary PHP code on a vulnerable system, reinstall the application from scratch, and compromise the entire system as the result. EspoCRM is also vulnerable to less critical Cross-Site Scripting attacks.


1. PHP File Inclusion in EspoCRM: CVE-2014-7985

The vulnerability exists due to absence of sanitization of input data passed via the "action" HTTP GET parameter to "/install/index.php" script before using them in PHP "include()" function. A remote unauthenticated attacker can include and execute arbitrary local PHP files on the system with privileges of the web server.

Successful exploitation of the vulnerability may allow complete application and system compromise.

Below is a simple PoC (Proof-of-Concept) code that uses path traversal technique to include "/tmp/file.php" file (you can include any other file, content of which you control):

http://[host]/install/index.php?installProcess=1&action=../../../../../../../../ tmp/file

The installation script is not deleted after installation, and is accesible without any authentication by default.


2. Improper Access Control in EspoCRM: CVE-2014-7986

The vulnerability is caused by insufficient access control restriction to the installation script "/install/index.php". Additionally the application fails to properly check whether it was already installed on the system. A remote attacker can set the "installProcess” HTTP GET parameter to 1 and reinstall the application.

The following HTP GET request starts a new installation process:

http://[host]/install/index.php?installProcess=1


3. Reflected Cross-Site Scripting (XSS) in EspoCRM: CVE-2014-7987

Input passed via the "desc" HTTP GET parameter to "/install/index.php" script is not properly sanitized before being returned to the user. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:

http://[host]/install/index.php?installProcess=1&action=errors&desc=%3Cscript%3E alert%28%27immuniweb%27%29;%3C/script%3E

-----------------------------------------------------------------------------------------------

Solution:

Update to EspoCRM 2.6.0

More Information:
http://blog.espocrm.com/news/espocrm-2-6-0-released/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23238 - https://www.htbridge.com/advisory/HTB23238 - Multiple vulnerabilities in EspoCRM.
[2] EspoCRM - http://www.espocrm.com/ - EspoCRM is an Open Source CRM (Customer Relationship Management) software that allows you to see, enter and evaluate all your company relationships regardless of the type.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close