Multiple vulnerabilities in EspoCRM

130.3k
4
11
21
4
More
4
12

Advisory ID:	HTB23238
Product:	EspoCRM
Vendor:	http://www.espocrm.com
Vulnerable Versions:	2.5.2 and probably prior
Tested Version:	2.5.2
Advisory Publication:	October 8, 2014 [without technical details]
Vendor Notification:	October 8, 2014
Vendor Fix:	October 10, 2014
Public Disclosure:	October 29, 2014
Latest Update:	October 15, 2014
Vulnerability Type:	PHP File Inclusion [CWE-98] Improper Access Control [CWE-284] Cross-Site Scripting [CWE-79]
CVE References:	CVE-2014-7985 CVE-2014-7986 CVE-2014-7987
Risk Level:	High

CVSSv2 Base Scores:	7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status:	Fixed by Vendor
Discovered and Provided:	High-Tech Bridge Security Research Lab
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple high-risk vulnerabilities in EspoCRM, which can be exploited by remote attacker to execute arbitrary PHP code on a vulnerable system, reinstall the application from scratch, and compromise the entire system as the result. EspoCRM is also vulnerable to less critical Cross-Site Scripting attacks. 1. PHP File Inclusion in EspoCRM: CVE-2014-7985 The vulnerability exists due to absence of sanitization of input data passed via the "action" HTTP GET parameter to "/install/index.php" script before using them in PHP "include()" function. A remote unauthenticated attacker can include and execute arbitrary local PHP files on the system with privileges of the web server. Successful exploitation of the vulnerability may allow complete application and system compromise. Below is a simple PoC (Proof-of-Concept) code that uses path traversal technique to include "/tmp/file.php" file (you can include any other file, content of which you control): http://[host]/install/index.php?installProcess=1&action=../../../../../../.. /../ tmp/file The installation script is not deleted after installation, and is accesible without any authentication by default. 2. Improper Access Control in EspoCRM: CVE-2014-7986 The vulnerability is caused by insufficient access control restriction to the installation script "/install/index.php". Additionally the application fails to properly check whether it was already installed on the system. A remote attacker can set the "installProcess” HTTP GET parameter to 1 and reinstall the application. The following HTP GET request starts a new installation process: http://[host]/install/index.php?installProcess=1 3. Reflected Cross-Site Scripting (XSS) in EspoCRM: CVE-2014-7987 Input passed via the "desc" HTTP GET parameter to "/install/index.php" script is not properly sanitized before being returned to the user. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. The exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word: http://[host]/install/index.php?installProcess=1&action=errors&desc=%3Cscrip t%3E alert%28%27immuniweb%27%29;%3C/script%3E
How to Detect PHP File Inclusion Vulnerabilities Website Security Test GDPR & PCI DSS Test Website CMS Security Test CSP & HTTP Headers Check WordPress & Drupal Scanning Try For Free Solution:
Update to EspoCRM 2.6.0 More Information: http://blog.espocrm.com/news/espocrm-2-6-0-released/

References:
[1] High-Tech Bridge Advisory HTB23238 - https://www.immuniweb.com/advisory/HTB23238 - Multiple vulnerabilities in EspoCRM. [2] EspoCRM - http://www.espocrm.com/ - EspoCRM is an Open Source CRM (Customer Relationship Management) software that allows you to see, enter and evaluate all your company relationships regardless of the type. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing. [6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.

Previous Security Advisories with CWE-284:

HTB23219: Improper Access Control in ArticleFR

HTB23202: Multiple Vulnerabilities in OpenDocMan

130.3k
4
11
21
4
More
4
12

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.