Exploit-DB #9450
Description: vTiger CRM 5.0.4 - Remote Code Execution / Cross-Site Request Forgery / Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-18
Author: USH

Exploit:
Vtiger CRM 5.0.4 Multiple Vulnerabilities

 Name              Multiple Vulnerabilities in Vtiger CRM
 Systems Affected  Vtiger CRM 5.0.4 and possibly earlier versions
 Severity          Medium
 Impact (CVSSv2)   Medium 6/10, vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P)
 Vendor            http://www.vtigercrm.com
 Advisory
http://www.ush.it/team/ush/hack-vtigercrm_504/vtigercrm_504.txt
 Authors           Giovanni "evilaliv3" Pellerano (evilaliv3 AT ush DOT it)
                   Antonio "s4tan" Parata (s4tan AT ush DOT it)
                   Francesco "ascii" Ongaro (ascii AT ush DOT it)
 Date              20090818

I. BACKGROUND

Vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal
for small and medium businesses, with low-cost product support available
to production users that need reliable support.

II. DESCRIPTION

Multiple Vulnerabilities exist in Vtiger CRM software.

Some of the technical issues highlighted in this advisory are part of a
wider publication, "PHP filesystem attack vectors - Take Two", and are
generic to applications written in the PHP language:
http://www.ush.it/2009/07/26/php-filesystem-attack-vectors-take-two/

III. ANALYSIS

Summary:

 A) Remote Code Execution (RCE) Vulnerability
 B) Cross Site Request Forgery (CSRF) Vulnerabilities
 C) Local File Inclusion (LFI) Vulnerability
 D) Cross Side Scripting (XSS) Vulnerability

A) Remote Code Execution (Windows Only) Vulnerability

A Remote Code Execution vulnerability exists in Vtiger CRM version
5.0.4. In order to exploit this vulnerability an account on the CRM
system is required.

The vulnerability resides in the "Compose Mail" section. The software
permits sending email with attachments and offers a draft save feature.
When this feature is requested and an attachment is specified, the
"saveForwardAttachments" validation routine is called.

This routine involves some security checks to handle uploaded files, it
does blacklist extension checking and if a bad extension is detected the
txt extension is appended to the file-name.

The following is the specific section:

--8<--8<--8<--8<--8<--8<--8<-Vtiger CRM 5.0.4 Multiple Vulnerabilities

 Name              Multiple Vulnerabilities in Vtiger CRM
 Systems Affected  Vtiger CRM 5.0.4 and possibly earlier versions
 Severity          Medium
 Impact (CVSSv2)   Medium 6/10, vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P)
 Vendor            http://www.vtigercrm.com
 Advisory
 Authors           Giovanni "evilaliv3" Pellerano (evilaliv3 AT ush DOT it)
                   Antonio "s4tan" Parata (s4tan AT ush DOT it)
                   Francesco "ascii" Ongaro (ascii AT ush DOT it)
 Date              20090818

I. BACKGROUND

Vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal
for small and medium businesses, with low-cost product support available
to production users that need reliable support.

II. DESCRIPTION

Multiple Vulnerabilities exist in Vtiger CRM software.

Some of the technical issues highlighted in this advisory are part of a
wider publication, "PHP filesystem attack vectors - Take Two", and are
generic to applications written in the PHP language:
http://www.ush.it/2009/07/26/php-filesystem-attack-vectors-take-two/

III. ANALYSIS

Summary:

 A) Remote Code Execution (RCE) Vulnerability
 B) Cross Site Request Forgery (CSRF) Vulnerabilities
 C) Local File Inclusion (LFI) Vulnerability
 D) Cross Side Scripting (XSS) Vulnerability

A) Remote Code Execution (Windows Only) Vulnerability

A Remote Code Execution vulnerability exists in Vtiger CRM version
5.0.4. In order to exploit this vulnerability an account on the CRM
system is required.

The vulnerability resides in the "Compose Mail" section. The software
permits sending email with attachments and offers a draft save feature.
When this feature is requested and an attachment is specified, the
"saveForwardAttachments" validation routine is called.

This routine involves some security checks to handle uploaded files, it
does blacklist extension checking and if a bad extension is detected the
txt extension is appended to the file-name.

The following is the specific section:

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

$ext_pos = strrpos($binFile, ".");
$ext = substr($binFile, $ext_pos + 1);
if (in_array(strtolower($ext), $upload_badext))
{
    $binFile .= ".txt";
}

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

It's known that in some circostances (for example when the PHP handler
is configured using AddType/Action/AddHandler globally, eg. not inside
an Apache's Files/FilesMatch directive) blacklisting is not enough as
files in the form of "filename.php.foo" will be mapped back to PHP
anyway (since foo is not explicitly defined in the MIME map and Apache
will try to guess the filetype by its own).

Beside this known issue we want to point out a less known exploitation
methodology that works on Windows hosts.

First the attacker has to find the name of the file that was uploaded
in the attachment list files. Vtiger CRM saves files in a path like:

storage/2009/July/week1/

And prepends an incremental unique number to the filename like:

133_foo.php

So, a hypothetical attacker has only to guess the prepended number. This
can be done by bruteforcing or by requesting the url:

http://127.0.0.1/vtigercrm/index.php?module=Emails&action=ListView

At this page Vtiger CRM shows the list of all the emails sent and saved,
and for every email it allows to download the attachment showing its
unique id in the link.

http://127.0.0.1/vtigercrm/index.php?module=uploads&action=downloadfile&
return_module=Emails&fileid=133&entityid=136

So, finally, the link to exploit this vulnerability should be something
like:

http://127.0.0.1/vtigercrm/storage/2009/July/week1/133.foo.php

While Vtiger CRM blocks known danger