[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <55C27568.8070503@xiphosresearch.co.uk>
Date: Wed, 05 Aug 2015 21:43:20 +0100
From: Darren Martyn <darren.martyn@...hosresearch.co.uk>
To: oss-security@...ts.openwall.com
Subject: CVE Request: SuiteCRM Post-Auth Race Condition Shell Upload Remote
Code Execution.
Hello List,
I am requesting a CVE to be issued for the SuiteCRM product. There
exists a race condition in the image upload verification component which
leads to a race condition wherein an uploaded piece of PHP code exists
on disc temporarily before being deleted, which can be leveraged to gain
code execution. This vulnerability was introduced in version 7.2.2, as a
patch to fix a prior code execution issue found in 7.2.1.
Github issue: https://github.com/salesagility/SuiteCRM/issues/333
Responsible commit:
https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5
Them being told it was a bad idea:
https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5#commitcomment-11281062
Video of exploitation: https://www.youtube.com/watch?v=eHVIg5eoYNc
A proof of concept exploit will be published in a couple of days along
with a dissection of the vulnerable components of the code and
explanation of how it all works and stuff.
Best regards,
Darren Martyn,
Security Researcher,
Xiphos Research Ltd.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
