egix@karmainsecurity ~ $

SugarCRM <= 9.0.1 Multiple Reflected Cross-Site Scripting Vulnerabilities

• Software Link:

https://www.sugarcrm.com

• Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

• Vulnerabilities Description:

  1. User input passed through the “form” parameter when handling the “Popup” action within the “DataSets” module is not properly sanitized before being used to generate HTML output. This can be exploited by malicious users to carry out Reflected Cross-Site Scripting (XSS) attacks.

  2. User input passed through the “name” parameter when handling the “Popup” action within the “DataSets” module is not properly sanitized before being used to generate HTML output. This can be exploited by malicious users to carry out Reflected Cross-Site Scripting (XSS) attacks.

  3. User input passed through the “type” parameter when handling the “dupcheck” action within the “Import” module is not properly sanitized before being used to generate HTML output. This can be exploited by malicious users to carry out Reflected Cross-Site Scripting (XSS) attacks.

  4. User input passed through the “message” parameter when handling the “error” action within the “Import” module is not properly sanitized before being used to generate HTML output. This can be exploited by malicious users to carry out Reflected Cross-Site Scripting (XSS) attacks.

  5. User input passed through the “direct_step” parameter when handling the “WizardNewsletter” action within the “Campaigns” module is not properly sanitized before being used to generate HTML output. This can be exploited by malicious users to carry out Reflected Cross-Site Scripting (XSS) attacks.

  6. User input passed through the “iframe_type” parameter when handling the “IframeDropdown” action within the “WorkFlow” module is not properly sanitized before being used to generate HTML output. This can be exploited by malicious users to carry out Reflected Cross-Site Scripting (XSS) attacks.

• Solution:

Upgrade to version 9.0.2, 8.0.4, or later.

• Disclosure Timeline:

[07/02/2019] – Vendor notified

[01/10/2019] – Versions 9.0.2 and 8.0.4 released

[10/10/2019] – Publication of this advisory

• Credits:

Vulnerabilities discovered by Egidio Romano.

• Other References:

https://support.sugarcrm.com/Documentation/Sugar_Versions/9.0/Ent/Sugar_9.0.2_Release_Notes