CVE-2019-15062: Dolibarr Cross-Site Request Forgery (CSRF)
Summary
CVE-2019-15062: Dolibarr Cross-Site Request Forgery (CSRF). Affects dolibarr/dolibarr versions >= 10.0, < 10.0.2. Fixed in 10.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides a wide range of features, including customer and supplier management, invoicing, inventory management, and more. Dolibarr is written in PHP and is available on Packagist. However, a vulnerability has been discovered in Dolibarr that allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability in Dolibarr arises from a flaw in the application's protection mechanism for CSRF attacks. Normally, Dolibarr checks the Referer header to prevent CSRF attacks. However, an attacker can exploit this vulnerability by storing an IFRAME element containing a CSRF request in the Linked Files settings page. When an admin visits this page, the attacker can take complete control over the admin account. Since the attack originates from within one of the application's own settings pages, the protection mechanism based on the Referer header is bypassed. This vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
Minimum fixed version
10.0.2
This is the first release that contains the fix.
composer require dolibarr/dolibarr:10.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Dolibarr to the latest version to mitigate the risk of CSRF attacks.
Conclusion
The vulnerability in Dolibarr allows an attacker to perform CSRF attacks and take control over an admin account. To mitigate this risk, it is crucial to update Dolibarr to version 10.0.2 or later. This update includes the necessary fixes to prevent CSRF attacks. If you require further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides various features for managing customers, suppliers, invoicing, and more.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In this case, an attacker can exploit the vulnerability in Dolibarr to perform CSRF attacks and take control over an admin account.
To protect your Dolibarr installation, it is crucial to update to version 10.0.2 or later. This update includes the necessary fixes to prevent CSRF attacks.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to update Dolibarr as soon as possible to mitigate the risk.
For further support on vulnerability remediation and assistance with updating Dolibarr, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
