Date: Wed, 02 Mar 2016 13:12:31 +0000 From: Darren Martyn <darren.martyn@...hosresearch.co.uk> To: oss-security@...ts.openwall.com Subject: CVE Request(s): VTigerCRM and SugarCRM Hi List, Requesting CVE's to be issued as appropriate for the following security issues. SugarCRM Incomplete Blacklist leading to shell upload. This is the exact same issue as CVE-2015-5946, except different product (CVE-2015-5946 was issued for SuiteCRM, which is a SugarCRM fork). Unsure if this needs a second CVE issued or not given it is a different product (same original codebase though). The version tested was SugarCRM Community Edition version 6.5.22. VTiger CRM Post-Auth Shell Upload. Version Tested: vtiger CRM 4.2 Patch 2 This is a similar issue to the original SugarCRM and SuiteCRM issues. Effectively, the filtering applied to prevent uploading executable files is insufficient and trivially bypassed, leading to remote code execution. The checks avoided are a horrible "check if there is PHP in the file" function, getimagesize(), a MIME type check, and a file extension check. Given that it is a different code-path entirely to the original SugarCRM codebase, it probably should be treated as a different issue. Details are outlined here, to avoid repeating the same information: http://xiphosresearch.com/2016/03/01/Vulnerability-Inheritance-across-Forks.html Both issues (SugarCRM and VTigerCRM) require authentication, however both clearly display bypass of intended security restrictions. Best regards, Darren Martyn. [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ