Suite 7.14.2 - RCE via LFI
9,9
Critical
Discovered by
Offensive Team, Fluid Attacks
Summary
Full name
Suite 7.14.2 - RCE via LFI
Code name
State
Public
Release date
Affected product
Suite CRM
Vendor
SuiteCRM
Affected version(s)
7.14.2
Fixed version(s)
7.14.4
Vulnerability name
Local file inclusion (LFI)
Vulnerability type
Remotely exploitable
Yes
CVSS v3.1 vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v3.1 base score
9.9
Exploit available
No
CVE ID(s)
Description
Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI.
Vulnerability
A local file inclusion (LFI) vulnerability has been identified in Suite CRM that, under certain conditions, could allow an attacker to obtain remote command execution. The attacker must have minimum privileges.
Vulnerable path
Below I will show you the vulnerable path in code, from the source to the sink.
Evidence of exploitation
Create a product and upload a malicious image
Include the image from the previous step with the LFI to achieve RCE
Our security policy
We have reserved the ID CVE-2024-1644 to refer to this issue from now on.
System Information
Suite CRM
Version: 7.14.2
Operating System: MacOS
References
Github repository: https://github.com/salesagility/SuiteCRM/
Patch: https://github.com/SuiteCRM/SuiteCRM/commit/504d6f0ebd5847169d73c52d312e91916a7280bb
Mitigation
An updated version of Suite CRM is available on the vendor page.
Credits
The vulnerability was discovered by Carlos Bello from Fluid Attacks' Offensive Team.
Timeline
Vulnerability discovered
Vendor contacted
Vendor replied
Vendor confirmed
Vulnerability patched
Public disclosure
Does your application use this vulnerable software?
During our free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.
