vtiger CRM <= 5.4.0 (customerportal.php) Two Local File Inclusion Vulnerabilities
• Software Link:
• Affected Versions:
[1] All versions from 5.1.0 to 5.4.0.
[2] All versions from 5.2.0 to 5.4.0.
• Vulnerabilities Description:
1) The vulnerable code is located in the get_list_values SOAP method defined in /soap/customerportal.php:
function get_list_values($id,$module,$sessionid,$only_mine='true') { require_once('modules/'.$module.'/'.$module.'.php'); require_once('include/utils/UserInfoUtil.php'); global $adb,$log,$current_user; $log->debug("Entering customer portal function get_list_values");
2) The vulnerable code is located in the get_project_components SOAP method defined in /soap/customerportal.php:
function get_project_components($id,$module,$customerid,$sessionid) { require_once("modules/$module/$module.php"); require_once('include/utils/UserInfoUtil.php'); global $adb,$log; $log->debug("Entering customer portal function get_project_components ..");
The vulnerabilities exist because these methods fail to properly validate input passed through the “module”
parameter, that is being used in a call to the require_once() function (lines 1530 and 2779). This might be
exploited to include arbitrary local files containing malicious PHP code. Successful exploitation of these
vulnerabilities requires the application running on PHP < 5.3.4, because a null byte injection is required.
• Solution:
Apply the vendor patch: http://www.vtiger.com/blogs/?p=1467
• Disclosure Timeline:
[13/01/2013] – Vendor notified
[06/02/2013] – Vendor asked feedback about this changeset
[05/03/2013] – Feedback provided to the vendor
[26/03/2013] – Vendor patch released
[18/04/2013] – CVE number requested
[20/04/2013] – CVE number assigned
[01/08/2013] – Public disclosure
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-3212 to these vulnerabilities.
• Credits:
Vulnerabilities discovered by Egidio Romano.