vtiger CRM <= 5.4.0 (customerportal.php) Two Local File Inclusion Vulnerabilities

• Software Link:

http://www.vtiger.com

• Affected Versions:

All versions from 5.1.0 to 5.4.0.

All versions from 5.2.0 to 5.4.0.

• Vulnerabilities Description:

The vulnerable code is located in the get_list_values() SOAP method defined in /soap/customerportal.php:

1528function get_list_values($id,$module,$sessionid,$only_mine='true')
1529{
1530    require_once('modules/'.$module.'/'.$module.'.php');
1531    require_once('include/utils/UserInfoUtil.php');
1532    global $adb,$log,$current_user;
1533    $log->debug("Entering customer portal function get_list_values");

The vulnerable code is located in the get_project_components() SOAP method defined in /soap/customerportal.php:

2778function get_project_components($id,$module,$customerid,$sessionid) {
2779    require_once("modules/$module/$module.php");
2780    require_once('include/utils/UserInfoUtil.php');
2781 
2782    global $adb,$log;
2783    $log->debug("Entering customer portal function get_project_components ..");

The vulnerabilities exist because these methods fail to properly validate input passed through the “module” parameter, that is being used in a call to the require_once() PHP function (lines 1530 and 2779). This might be exploited to include arbitrary local files containing malicious PHP code. Successful exploitation of these vulnerabilities requires the application running on PHP < 5.3.4, because a null byte injection is required.

• Solution:

Apply the vendor patch: http://www.vtiger.com/blogs/?p=1467

• Disclosure Timeline:

[13/01/2013] – Vendor notified

[06/02/2013] – Vendor asked feedback about this changeset

[05/03/2013] – Feedback provided to the vendor

[26/03/2013] – Vendor patch released

[18/04/2013] – CVE number requested

[20/04/2013] – CVE number assigned

[01/08/2013] – Public disclosure

• CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-3212 to these vulnerabilities.

• Credits:

Vulnerabilities discovered by Egidio Romano.