CVE-2024-29477: Dolibarr ERP CRM Code Injection vulnerability during installation
Summary
CVE-2024-29477: Dolibarr ERP CRM Code Injection vulnerability during installation. Affects dolibarr/dolibarr versions < 19.0.0. No fix is published. How to fix ↓
Also tracked for
- dolibarr · Bitnami
The same CVE-2024-29477 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dolibarr ERP CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, accounting, and more. Dolibarr is written in PHP and is available on Packagist. Unfortunately, versions up to 19.0.0 are vulnerable to a code injection vulnerability during the installation process.
Vulnerability Detail
The vulnerability in Dolibarr ERP CRM arises due to a lack of sanitization during the installation process. An attacker with adjacent access to the network can exploit this vulnerability by providing a specifically crafted input. This allows the attacker to execute arbitrary code on the target system. The impact of this vulnerability can be severe, as it grants unauthorized access and control over the affected system. It is important to note that this vulnerability requires adjacent network access, meaning the attacker needs to be within the same network as the target.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to restrict network access to the Dolibarr ERP CRM installation. By implementing proper network segmentation and access controls, the risk of an adjacent attacker exploiting this vulnerability can be mitigated. Additionally, it is crucial to monitor network activity and promptly investigate any suspicious behavior.
Conclusion
The code injection vulnerability in Dolibarr ERP CRM during the installation process poses a significant risk to the security and integrity of the system. It is crucial to update to a version beyond 19.0.0 to ensure the vulnerability is patched. Implementing network segmentation and access controls can provide temporary mitigation until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dolibarr/dolibarr →
FAQ
Dolibarr ERP CRM is an open-source software package that provides enterprise resource planning (ERP) and customer relationship management (CRM) functionalities. It is widely used for managing various business processes, including sales, inventory, accounting, and more.
Code injection is a type of vulnerability where an attacker can insert malicious code into a system or application. This code is then executed by the system, potentially leading to unauthorized access, data breaches, or other malicious activities.
This vulnerability allows an attacker with adjacent network access to execute arbitrary code on the target system during the installation process. This can lead to unauthorized access, data manipulation, and potential compromise of the entire Dolibarr ERP CRM installation.
Yes, the developers of Dolibarr ERP CRM have addressed this vulnerability in versions beyond 19.0.0. It is recommended to update to the latest version to ensure the vulnerability is patched.
As a temporary workaround, it is advised to restrict network access to the Dolibarr ERP CRM installation. By implementing proper network segmentation and access controls, the risk of an adjacent attacker exploiting this vulnerability can be mitigated. Additionally, it is crucial to monitor network activity and promptly investigate any suspicious behavior.
Related vulnerabilities
Recent vulnerabilities recorded for dolibarr/dolibarr.
