SugarCRM <= 9.0.1 Multiple Path Traversal Vulnerabilities
• Software Link:
• Affected Versions:
Version 9.0.1 and prior versions, 8.0.3 and prior versions.
• Vulnerabilities Description:
-
User input passed to the "/Mail/attachment" REST API endpoint is not properly sanitized before being used to delete a file from the system. This can be exploited by malicious users to delete arbitrary files via Path Traversal attacks. Please note this vulnerability could be exploited to delete the config.php file and re-install the application, potentially leading to a full server compromise.
-
User input passed through the “temp_id” parameter to the "/[module]/temp/file" REST API endpoint is not properly sanitized before being used to download/delete a file from the system. This can be exploited by malicious users to download and/or delete arbitrary files via Path Traversal attacks. Please note this vulnerability could be exploited to download and delete the config.php file and re-install the application, potentially leading to a full server compromise.
-
User input passed through the “dropdown_lang” parameter when handling the “wizard” action within the “Studio” module is not properly sanitized before being used in a call to the include() PHP function. This can be exploited by malicious users to upload and execute arbitrary PHP code via Path Traversal attacks. Successful exploitation of this vulnerability requires an user account with Developer access to any module.
-
User input passed through the “filename” parameter when handling the “deleteFont” action within the “Configurator” module is not properly sanitized before being used to delete a file from the system. This can be exploited by malicious users to delete arbitrary files. Please note this vulnerability could be exploited to delete the config.php file and re-install the application, potentially leading to a full server compromise. Successful exploitation of this vulnerability requires a System Administrator account.
• Solution:
Upgrade to version 9.0.2, 8.0.4, or later.
• Disclosure Timeline:
[07/02/2019] – Vendor notified
[01/10/2019] – Versions 9.0.2 and 8.0.4 released
[10/10/2019] – Publication of this advisory
• Credits:
Vulnerabilities discovered by Egidio Romano.
• Other References:
https://support.sugarcrm.com/Documentation/Sugar_Versions/9.0/Ent/Sugar_9.0.2_Release_Notes