Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 05 Aug 2015 21:43:20 +0100
From: Darren Martyn <darren.martyn@...hosresearch.co.uk>
To: oss-security@...ts.openwall.com
Subject: CVE Request: SuiteCRM Post-Auth Race Condition Shell Upload Remote
 Code Execution.

Hello List,
I am requesting a CVE to be issued for the SuiteCRM product. There
exists a race condition in the image upload verification component which
leads to a race condition wherein an uploaded piece of PHP code exists
on disc temporarily before being deleted, which can be leveraged to gain
code execution. This vulnerability was introduced in version 7.2.2, as a
patch to fix a prior code execution issue found in 7.2.1.

Github issue: https://github.com/salesagility/SuiteCRM/issues/333
Responsible commit:
https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5
Them being told it was a bad idea:
https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5#commitcomment-11281062
Video of exploitation: https://www.youtube.com/watch?v=eHVIg5eoYNc

A proof of concept exploit will be published in a couple of days along
with a dissection of the vulnerable components of the code and
explanation of how it all works and stuff.

Best regards,
Darren Martyn,
Security Researcher,
Xiphos Research Ltd.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.