SugarCRM 6.5.18 fopen() Command Injection / XSS / SSRF

`-----------------------------------------------------------------------------  
SugarCRM <= 6.5.18 (MySugar::addDashlet) Insecure fopen() Usage Vulnerability  
-----------------------------------------------------------------------------  
  
  
[-] Software Link:  
  
http://www.sugarcrm.com/  
  
  
[-] Affected Versions:  
  
Version 6.5.18 CE and other versions.  
  
  
[-] Vulnerability Description:  
  
The vulnerable code is located within the MySugar::addDashlet() method:  
  
89. if (isset($_REQUEST['type']) && $_REQUEST['type'] == 'web') {  
90. $dashlet_module = 'Home';  
91. require_once('include/Dashlets/DashletRssFeedTitle.php');  
92. $options['url'] = $_REQUEST['type_module'];  
93. $webDashlet = new DashletRssFeedTitle($options['url']);  
94. $options['title'] = $webDashlet->generateTitle();  
  
User input passed through the "type_module" request parameter isn’t properly sanitized before being used  
to instantiate a new DashletRssFeedTitle object, and this could be exploited to carry out certain attacks  
because of the DashletRssFeedTitle::readFeed() method (user input passed directly to the "fopen()" function):  
  
71. public function readFeed() {  
72. if ($this->url) {  
73. $fileOpen = @fopen($this->url, 'r');  
74. if ($fileOpen) {  
75. $this->fileOpen = true;  
76. $this->contents = fread($fileOpen, $this->readBytes);  
77. fclose($fileOpen);  
78. return true;  
79. }  
  
This can be exploited by authenticated attackers to carry out Server-Side Request Forgery (SSRF) attacks,  
potentially read content of arbitrary files, initiate a Cross-Site Scripting (XSS) attack, or execute  
arbitrary OS commands when the "expect" extension is installed through the following URL:  
  
http://[host]/[sugar]/index.php?module=Home&action=DynamicAction&DynamicAction=addDashlet&id=1&type=web&type_module=expect://[cmd]  
  
  
[-] Solution:  
  
Update to version 6.5.19 CE or higher to partially mitigate the vulnerability.  
No official solution is currently available against the SSRF and XSS attack vectors.  
  
  
[-] Disclosure Timeline:  
  
[15/10/2014] - Vendor notified  
[15/12/2014] - Version 6.5.19 CE released: http://bit.do/sugar6519  
[29/04/2015] - CVE number requested  
[23/06/2016] - Public disclosure  
  
  
[-] CVE Reference:  
  
The Common Vulnerabilities and Exposures project (cve.mitre.org)  
has not assigned a CVE identifier for this vulnerability.  
  
  
[-] Credits:  
  
Vulnerability discovered by Egidio Romano.  
  
  
[-] Original Advisory:  
  
http://karmainsecurity.com/KIS-2016-06  
  
  
  
`