oss-sec mailing list archives
CVE Request: SuiteCRM Post-Auth Race Condition Shell Upload Remote Code Execution.
From: Darren Martyn <darren.martyn () xiphosresearch co uk>
Date: Wed, 05 Aug 2015 21:43:20 +0100
Hello List, I am requesting a CVE to be issued for the SuiteCRM product. There exists a race condition in the image upload verification component which leads to a race condition wherein an uploaded piece of PHP code exists on disc temporarily before being deleted, which can be leveraged to gain code execution. This vulnerability was introduced in version 7.2.2, as a patch to fix a prior code execution issue found in 7.2.1. Github issue: https://github.com/salesagility/SuiteCRM/issues/333 Responsible commit: https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5 Them being told it was a bad idea: https://github.com/salesagility/SuiteCRM/commit/b1b3fd61c7697ad2073cd253d31c9462929e7bb5#commitcomment-11281062 Video of exploitation: https://www.youtube.com/watch?v=eHVIg5eoYNc A proof of concept exploit will be published in a couple of days along with a dissection of the vulnerable components of the code and explanation of how it all works and stuff. Best regards, Darren Martyn, Security Researcher, Xiphos Research Ltd.
Current thread:
- CVE Request: SuiteCRM Post-Auth Race Condition Shell Upload Remote Code Execution. Darren Martyn (Aug 05)