SugarCRM <= 6.5.18 (MySugar::addDashlet) Insecure fopen() Usage Vulnerability
• Software Link:
• Affected Versions:
Version 6.5.18 CE and other versions.
• Vulnerability Description:
The vulnerable code is located within the MySugar::addDashlet() method:
if (isset($_REQUEST['type']) && $_REQUEST['type'] == 'web') { $dashlet_module = 'Home'; require_once('include/Dashlets/DashletRssFeedTitle.php'); $options['url'] = $_REQUEST['type_module']; $webDashlet = new DashletRssFeedTitle($options['url']); $options['title'] = $webDashlet->generateTitle();
User input passed through the “type_module” request parameter isn’t properly sanitized before being used to instantiate a new DashletRssFeedTitle object, and this could be exploited to carry out certain attacks because of the DashletRssFeedTitle::readFeed() method (user input passed directly to the “fopen()” function):
public function readFeed() { if ($this->url) { $fileOpen = @fopen($this->url, 'r'); if ($fileOpen) { $this->fileOpen = true; $this->contents = fread($fileOpen, $this->readBytes); fclose($fileOpen); return true; }
This can be exploited by authenticated attackers to carry out Server-Side Request Forgery (SSRF) attacks, potentially read content of arbitrary files, initiate a Cross-Site Scripting (XSS) attack, or execute arbitrary OS commands when the “expect” extension is installed through the following URL:
http://[host]/[sugar]/index.php?module=Home&action=DynamicAction&DynamicAction=addDashlet&id=1&type=web&type_module=expect://[cmd]
• Solution:
Update to version 6.5.19 CE or higher to partially mitigate the vulnerability.
No official solution is currently available against the SSRF and XSS attack vectors.
• Disclosure Timeline:
[15/10/2014] – Vendor notified
[15/12/2014] – Version 6.5.19 CE released: https://goo.gl/jucc0C
[29/04/2015] – CVE number requested
[23/02/2016] – Public disclosure
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has not yet assigned a CVE identifier for the vulnerability.
• Credits:
Vulnerability discovered by Egidio Romano.