Multiple vulnerabilities in EspoCRM

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxxx>]

Advisory ID: HTB23238
Product: EspoCRM
Vendor: http://www.espocrm.com
Vulnerable Version(s): 2.5.2 and probably prior
Tested Version: 2.5.2
Advisory Publication:  October 8, 2014  [without technical details]
Vendor Notification: October 8, 2014 
Vendor Patch: October 10, 2014 
Public Disclosure: October 29, 2014 
Vulnerability Type: PHP File Inclusion [CWE-98], Improper Access Control 
[CWE-284], Cross-Site Scripting [CWE-79]
CVE References: CVE-2014-7985, CVE-2014-7986, CVE-2014-7987
Risk Level: High 
CVSSv2 Base Scores: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C), 5 
(AV:N/AC:L/Au:N/C:N/I:N/A:P), 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple high-risk 
vulnerabilities in EspoCRM, which can be exploited by remote attacker to 
execute arbitrary PHP code on a vulnerable system, reinstall the application 
from scratch, and compromise the entire system as the result. EspoCRM is also 
vulnerable to less critical Cross-Site Scripting attacks.


1. PHP File Inclusion in EspoCRM: CVE-2014-7985

The vulnerability exists due to absence of sanitization of input data passed 
via the "action" HTTP GET parameter to "/install/index.php" script before using 
them in PHP "include()" function. A remote unauthenticated attacker can include 
and execute arbitrary local PHP files on the system with privileges of the web 
server. 

Successful exploitation of the vulnerability may allow complete application and 
system compromise. 

Below is a simple PoC (Proof-of-Concept) code that uses path traversal 
technique to include "/tmp/file.php" file (you can include any other file, 
content of which you control):

http://[host]/install/index.php?installProcess=1&action=../../../../../../../../
 tmp/file

The installation script is not deleted after installation, and is accesible 
without any authentication by default. 


2. Improper Access Control in EspoCRM: CVE-2014-7986

The vulnerability is caused by insufficient access control restriction to the 
installation script "/install/index.php". Additionally the application fails to 
properly check whether it was already installed on the system. A remote 
attacker can set the "installProcess” HTTP GET parameter to 1 and reinstall the 
application. 

The following HTP GET request starts a new installation process:

http://[host]/install/index.php?installProcess=1


3. Reflected Cross-Site Scripting (XSS) in EspoCRM: CVE-2014-7987

Input passed via the "desc" HTTP GET parameter to "/install/index.php" script 
is not properly sanitized before being returned to the user. A remote attacker 
can trick a user to open a specially crafted link and execute arbitrary HTML 
and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to 
display "immuniweb" word:

http://[host]/install/index.php?installProcess=1&action=errors&desc=%3Cscript%3E
 alert%28%27immuniweb%27%29;%3C/script%3E

-----------------------------------------------------------------------------------------------

Solution:

Update to EspoCRM 2.6.0

More Information:
http://blog.espocrm.com/news/espocrm-2-6-0-released/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23238 - 
https://www.htbridge.com/advisory/HTB23238 - Multiple vulnerabilities in 
EspoCRM.
[2] EspoCRM - http://www.espocrm.com/ - EspoCRM is an Open Source CRM (Customer 
Relationship Management) software that allows you to see, enter and evaluate 
all your company relationships regardless of the type.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual 
web application penetration test and cutting-edge vulnerability scanner 
available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.