full-disclosure - [FD] [KIS-2019-06] SugarCRM <= 9.0.1 Multiple Path Traversal Vulnerabilities

Open Source and information security mailing list archives

Date: Thu, 10 Oct 2019 20:38:43 +0200
From: Egidio Romano <research@...mainsecurity.com>
To: fulldisclosure@...lists.org
Subject: [FD] [KIS-2019-06] SugarCRM <= 9.0.1 Multiple Path Traversal
 Vulnerabilities

---------------------------------------------------------
SugarCRM <= 9.0.1 Multiple Path Traversal Vulnerabilities
---------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) User input passed to the "/Mail/attachment" REST API endpoint is not 
properly
sanitized before being used to delete a file from the system. This can 
be exploited
by malicious users to delete arbitrary files via Path Traversal attacks. 
Please
note this vulnerability could be exploited to delete the 'config.php' 
file and
re-install the application, potentially leading to a full server 
compromise.

2) User input passed through the "temp_id" parameter to the 
"/[module]/temp/file"
REST API endpoint is not properly sanitized before being used to 
download/delete a
file from the system. This can be exploited by malicious users to 
download and/or
delete arbitrary files via Path Traversal attacks. Please note this 
vulnerability
could be exploited to download and delete the 'config.php' file and 
re-install
the application, potentially leading to a full server compromise.

3) User input passed through the "dropdown_lang" parameter when handling 
the "wizard"
action within the "Studio" module is not properly sanitized before being 
used in a
call to the include() PHP function. This can be exploited by malicious 
users to upload
and execute arbitrary PHP code via Path Traversal attacks. Successful 
exploitation
of this vulnerability requires an user account with Developer access to 
any module.

4) User input passed through the "filename" parameter when handling the 
"deleteFont"
action within the "Configurator" module is not properly sanitized before 
being used
to delete a file from the system. This can be exploited by malicious 
users to delete
arbitrary files. Please note this vulnerability could be exploited to 
delete the
'config.php' file and re-install the application, potentially leading to 
a full
server compromise. Successful exploitation of this vulnerability 
requires a
System Administrator account.

[-] Solution:

Upgrade to version 9.0.2, 8.0.4, or later.

[-] Disclosure Timeline:

[07/02/2019] - Vendor notified
[01/10/2019] - Versions 9.0.2 and 8.0.4 released
[10/10/2019] - Publication of this advisory

[-] Credits:

Vulnerabilities discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2019-06

[-] Other References:

https://support.sugarcrm.com/Documentation/Sugar_Versions/9.0/Ent/Sugar_9.0.2_Release_Notes

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives