477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
61 lines
4.3 KiB
Text
Executable file
61 lines
4.3 KiB
Text
Executable file
Name SugarCRM – Local File Disclosure
|
||
SugarCRM http://www.sugarcrm.com/docs/Release_Notes/OpenSource_ReleaseNotes_4.5.1j/
|
||
Advisories Sugar_Release_Notes_4.5.1j.2.6.html (Bug 20522)
|
||
http://dl.sugarforge.org/sugarcrm/SugarCE5.0Latest/SugarCE5.0.0/
|
||
Sugar_CommunityEdition_ReleaseNotes_5.0c.pdf (Bug 20342)
|
||
Date Released 4.5.1j in March 24, 2008 and 5.0.0c in April 4, 2008
|
||
Affected Software SugarCRM - Community Edition Version 5.0.0
|
||
SugarCRM – Community Edition Version 4.5.1
|
||
Researcher Roberto Suggi Liverani roberto.suggi@security-assessment.com
|
||
|
||
Description
|
||
SugarCRM Community Edition is vulnerable to local file contents disclosure. This
|
||
vulnerability can be exploited by a malicious user to disclose potentially sensitive
|
||
information. The flaw is caused due to a lack of input filtering in the SugarCRM RSS
|
||
module, which can be exploited to disclose the content of local files.
|
||
The RSS module allows SugarCRM users to add RSS feeds to their personal RSS list. The application expects an
|
||
URL value pointing to a valid RSS feed. However, the URL variable value is not properly sanitised and any URI
|
||
value can be entered instead. In this particular case, it was discovered that it is possible to enter a file path to
|
||
any files on the local system hosting the SugarCRM application.
|
||
As a result SugarCRM does not display the new RSS feed in the list as it is not a valid RSS URL Feed. However,
|
||
the application creates a local file with the filename of the md5 hash of the URL entered. The file is created in
|
||
the directory cache/feeds . If the Apache web server is used, the file is created with the user www-data
|
||
containing read permission.
|
||
|
||
Exploitation
|
||
An exploitation example in a LAMP (Linux, Apache, Mysql, PHP) environment:
|
||
If an authenticated attacker enters a value of “/etc/passwd†(without quotes) in the RSS URL field, the
|
||
application will generate a MD5 hash of the string containing the file path. In this case, the value “/etc/passwdâ€
|
||
is hashed to “c5068b7c2b1707f8939b283a2758a691†(without quotes). The MD5 hash is then used as a
|
||
filename with the file contents of /etc/passwd. The file /etc/passwd can then be viewable publicly at
|
||
http://sugarwebsiteaddress/cache/feeds/c5068b7c2b1707f8939b283a2758a691 .
|
||
|
||
Exploitation of this flaw does not require authentication.
|
||
The URL variable is handled by the /modules/Feeds/Feed.php page. The array variable $url is passed without
|
||
filtering to the xml_domit_rss_document function at the following line:
|
||
$rssdoc = new xml_domit_rss_document ($this->url, ‘cache/feeds/’, 3600);
|
||
The XML domit RSS plugin is then called and retrieves the file content at the path given and then generate the
|
||
MD5 hashed file in the cache/feeds folder as instructed by the function in Feed.php .
|
||
|
||
Solution
|
||
Install the vendor supplied patches.
|
||
Patch 4.5.1j: http://www.sugarcrm.com/forums/showthread.php?t=31688
|
||
Patch 5.0.0c: http://www.sugarcrm.com/forums/showthread.php?t=32252
|
||
|
||
About Security-Assessment.com
|
||
Security-Assessment.com is Australasia’s leading team of Information Security consultants specialising in
|
||
providing high quality Information Security services to clients throughout the Asia Pacific region. Our clients
|
||
include some of the largest globally recognised companies in areas such as finance, telecommunications,
|
||
broadcasting, legal and government. Our aim is to provide the very best independent advice and a high level of
|
||
technical expertise while creating long and lasting professional relationships with our clients.
|
||
Security-Assessment.com is committed to security research and development, and its team continues to identify
|
||
and responsibly publish vulnerabilities in public and private software vendor's products. Members of the
|
||
Security-Assessment.com R&D team are globally recognised through their release of whitepapers and
|
||
presentations related to new security research.
|
||
|
||
For further information on this issue or any of our service offerings, contact us
|
||
Web www.security-assessment.com
|
||
Email info@security-assessment.com
|
||
Phone +649 302 5093
|
||
|
||
# milw0rm.com [2008-04-29]
|