Executive brief
SuiteCRM, a popular open-source customer relationship management platform, contains a security flaw in how it handles file attachment deletions. An unauthenticated attacker can exploit this to modify sensitive database information, such as changing the administrator's email address. This could lead to a full takeover of the CRM system and unauthorized access to customer data.
Technical details
A type confusion vulnerability (CWE-843) exists in SuiteCRM within the processing of the 'module' parameter of the 'deleteAttachment' function. The root cause is the application's failure to properly validate or enforce expected types when handling this parameter, allowing an attacker to manipulate the logic of database interactions. A remote, unauthenticated attacker can exploit this over the network to alter arbitrary database objects. Demonstrated impacts include the ability to change the administrator's email address, which can facilitate account takeover. The issue is resolved in SuiteCRM version 7.12.6.
Affected products
- SalesAgility SuiteCRM < 7.12.6
Timeline
- 2022-03-02: disclosed: Disclosed to vendor
- 2022-06-09: advisory: Public disclosure by Exodus Intelligence
- 2022-06-09: patched: Vendor release of version 7.12.6