Date: Wed, 05 Aug 2015 21:43:20 +0100 From: Darren Martyn <darren.martyn@...hosresearch.co.uk> To: oss-security@...ts.openwall.com Subject: CVE Request: SuiteCRM Post-Auth Race Condition Shell Upload Remote Code Execution. Hello List, I am requesting a CVE to be issued for the SuiteCRM product. There exists a race condition in the image upload verification component which leads to a race condition wherein an uploaded piece of PHP code exists on disc temporarily before being deleted, which can be leveraged to gain code execution. This vulnerability was introduced in version 7.2.2, as a patch to fix a prior code execution issue found in 7.2.1. Github issue: https://github.com/salesagility/SuiteCRM/issues/333 Responsible commit: https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5 Them being told it was a bad idea: https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5#commitcomment-11281062 Video of exploitation: https://www.youtube.com/watch?v=eHVIg5eoYNc A proof of concept exploit will be published in a couple of days along with a dissection of the vulnerable components of the code and explanation of how it all works and stuff. Best regards, Darren Martyn, Security Researcher, Xiphos Research Ltd.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ