full-disclosure - [FD] [KIS-2016-06] SugarCRM <= 6.5.18 (MySugar::addDashlet) Insecure fopen() Usage Vulnerability

Open Source and information security mailing list archives

Message-ID: <576C5D04.2070206@karmainsecurity.com>
Date: Fri, 24 Jun 2016 00:04:52 +0200
From: Egidio Romano <research@...mainsecurity.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [FD] [KIS-2016-06] SugarCRM <= 6.5.18 (MySugar::addDashlet)
 Insecure fopen() Usage Vulnerability

-----------------------------------------------------------------------------
SugarCRM <= 6.5.18 (MySugar::addDashlet) Insecure fopen() Usage Vulnerability
-----------------------------------------------------------------------------

[-] Software Link:

http://www.sugarcrm.com/

[-] Affected Versions:

Version 6.5.18 CE and other versions.

[-] Vulnerability Description:

The vulnerable code is located within the MySugar::addDashlet() method:

89.	  if (isset($_REQUEST['type']) && $_REQUEST['type'] == 'web') {
90.		$dashlet_module = 'Home';
91.		require_once('include/Dashlets/DashletRssFeedTitle.php');
92.		$options['url'] = $_REQUEST['type_module'];
93.		$webDashlet = new DashletRssFeedTitle($options['url']);
94.		$options['title'] = $webDashlet->generateTitle();

User input passed through the "type_module" request parameter isn’t properly sanitized before being used
to instantiate a new DashletRssFeedTitle object, and this could be exploited to carry out certain attacks
because of the DashletRssFeedTitle::readFeed() method (user input passed directly to the "fopen()" function):

71.		public function readFeed() {
72.			if ($this->url) {
73.				$fileOpen = @fopen($this->url, 'r');
74.				if ($fileOpen) {
75.					$this->fileOpen = true;
76.					$this->contents = fread($fileOpen, $this->readBytes);
77.					fclose($fileOpen);
78.					return true;
79.				}

This can be exploited by authenticated attackers to carry out Server-Side Request Forgery (SSRF) attacks,
potentially read content of arbitrary files, initiate a Cross-Site Scripting (XSS) attack, or execute
arbitrary OS commands when the "expect" extension is installed through the following URL:

http://[host]/[sugar]/index.php?module=Home&action=DynamicAction&DynamicAction=addDashlet&id=1&type=web&type_module=expect://[cmd]

[-] Solution:

Update to version 6.5.19 CE or higher to partially mitigate the vulnerability.
No official solution is currently available against the SSRF and XSS attack vectors.

[-] Disclosure Timeline:

[15/10/2014] - Vendor notified
[15/12/2014] - Version 6.5.19 CE released: http://bit.do/sugar6519
[29/04/2015] - CVE number requested
[23/06/2016] - Public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has not assigned a CVE identifier for this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-06

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives