SugarCRM <= 9.0.1 Multiple PHP Object Injection Vulnerabilities
• Software Link:
• Affected Versions:
Version 9.0.1 and prior versions, 8.0.3 and prior versions.
• Vulnerabilities Description:
-
The vulnerability exists because the "/modules/Emails/DetailView.php" script is using the
unserialize()PHP function with the “campaign_data” field of the table, and such a value can be arbitrarily manipulated through the “save2” action. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the "/modules/EmailMan/views/view.config.php" script is using the
unserialize()PHP function with the "$sugar_config[‘email_xss’]" variable, and such a value can be arbitrarily manipulated through the “Configurator” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. Successful exploitation of this vulnerability requires a System Administrator account. -
User input passed through the “ext4” parameter when handling the “RefreshField” action within the “ModuleBuilder” module (when the “type” parameter is set to “enum”) is not properly sanitized before being used in a call to the
unserialize()PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. Successful exploitation of this vulnerability requires an user account with Developer access to any module. -
User input passed through the “ext4” parameter when handling the “RefreshField” action within the “ModuleBuilder” module (when the “type” parameter is set to “multienum”) is not properly sanitized before being used in a call to the
unserialize()PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. Successful exploitation of this vulnerability requires an user account with Developer access to any module. -
The vulnerability exists because the “SubPanelDefinitions::get_hidden_subpanels()" method is using the
unserialize()PHP function with the “MySettings_hide_subpanels” setting variable, and such a value can be arbitrarily manipulated through the “MergeRecords” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the “TabController::get_system_tabs()" method is using the
unserialize()PHP function with the “MySettings_tab” setting variable, and such a value can be arbitrarily manipulated through the “MergeRecords” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the “OpportunitySetup::setConfigSetting()" method is using the
unserialize()PHP function with the “MySettings_hide_subpanels” setting variable, and such a value can be arbitrarily manipulated through the “MergeRecords” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the “PackageManager::getinstalledPackages()" method is using the
unserialize()PHP function with the “manifest” field of the ‘upgrade_history’ table, and such a value can be arbitrarily manipulated through the “MergeRecords” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. Successful exploitation of this vulnerability requires a System Administrator account. -
The vulnerability exists because the “UpgradeSavedSearch::__construct()" method is using the
unserialize()PHP function with the “contents” field of the ‘saved_search’ table, and such a value can be arbitrarily manipulated through the “MergeRecords” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the “UserPreference::reloadPreferences()" method is using the
unserialize()PHP function with the “contents” field of the ‘user_preferences’ table, and such a value can be arbitrarily manipulated through the “MergeRecords” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the “TeamSetManager::cleanUp()" method is using the
unserialize()PHP function with the “contents” field of the ‘user_preferences’ table, and such a value can be arbitrarily manipulated through the “MergeRecords” module. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. Successful exploitation of this vulnerability requires an user account with Admin access to the Users/Teams/Roles modules. -
User input passed through the "$_FILES[‘VKFile’]" parameter when handling the “LicenseSettings” action within the “Administration” module is not properly sanitized before being used in a call to the
unserialize()PHP function within the “check_now()" function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. Successful exploitation of this vulnerability requires a System Administrator account. -
The vulnerability exists because the "/modules/Administration/Updater.php” script is using the
unserialize()PHP function with the “license_latest_versions” setting variable, and such a value can be arbitrarily manipulated in different ways. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the "/modules/Administration/metadata/adminpaneldefs.php” script is using the
unserialize()PHP function with the “license_latest_versions” setting variable, and such a value can be arbitrarily manipulated in different ways. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code. -
The vulnerability exists because the “authenticateDownloadKey()" function is using the
unserialize()PHP function with the “license_validation_key” setting variable, and such a value can be arbitrarily manipulated in different ways. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code.
• Solution:
Upgrade to version 9.0.2, 8.0.4, or later.
• Disclosure Timeline:
[07/02/2019] – Vendor notified
[01/10/2019] – Versions 9.0.2 and 8.0.4 released
[10/10/2019] – Publication of this advisory
• Credits:
Vulnerabilities discovered by Egidio Romano.
• Other References:
https://support.sugarcrm.com/Documentation/Sugar_Versions/9.0/Ent/Sugar_9.0.2_Release_Notes