CVE-2021-33816: Dolibarr remote PHP code execution
Summary
CVE-2021-33816: Dolibarr remote PHP code execution. Affects dolibarr/dolibarr versions >= 13.0.2, < 14.0.0. Fixed in 14.0.0. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2021-33816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It provides a range of features including accounting, inventory management, project management, and more. The vulnerability in question affects Dolibarr version 13.0.2. Dolibarr's website builder module is susceptible to remote PHP code execution due to an incomplete protection mechanism. While system, exec, and shell_exec functions are blocked, backticks are not, leading to potential code execution.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary PHP code on the affected Dolibarr instance. By exploiting the incomplete protection mechanism, an attacker can bypass the restrictions and execute malicious code. This can lead to various consequences, including unauthorized access, data theft, and further compromise of the system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
14.0.0
This is the first release that contains the fix.
composer require dolibarr/dolibarr:14.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually blocking backticks in the protection mechanism. This can be achieved by modifying the relevant code in the website builder module to include backtick blocking alongside the existing restrictions on system, exec, and shell_exec functions. Here's an example of how the code can be modified:
// Existing code
if (!empty($code) && !preg_match('/(system|exec|shell_exec)/i', $code)) {
// Code execution
}
// Modified code
if (!empty($code) && !preg_match('/(system|exec|shell_exec|`)/i', $code)) {
// Code execution
}
Conclusion
In conclusion, Dolibarr version 13.0.2 is vulnerable to remote PHP code execution due to an incomplete protection mechanism. Upgrading to Dolibarr version 14.0.0 or later is the recommended solution to address this vulnerability. If immediate upgrade is not possible, implementing the provided workaround can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr is an open-source ERP and CRM software designed for small and medium-sized businesses. It offers a range of features to manage various aspects of business operations.
The vulnerability allows remote PHP code execution, enabling an attacker to execute arbitrary code on the affected Dolibarr instance. This can lead to unauthorized access, data theft, and further compromise of the system.
To fix this vulnerability, it is recommended to upgrade Dolibarr to version 14.0.0 or later. This will ensure that the vulnerability is patched and the system is secure.
Yes, if upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually blocking backticks in the protection mechanism. This involves modifying the relevant code in the website builder module to include backtick blocking alongside the existing restrictions on system, exec, and shell_exec functions.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
