PT-2020-13935 · Dolibarr · Dolibarr

Andrea Gonzalez · Published 2020-09-02 · Updated 2022-05-24 · CVE-2020-14209

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 11.0.5

Description The issue allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This is possible because files with .pht and .phar extensions can be uploaded. Additionally, a .htaccess file can be uploaded to reconfigure access control, such as allowing .noexe files to be executed as PHP code, thereby defeating the .noexe protection mechanism.

Recommendations For versions prior to 11.0.5, update to version 11.0.5 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only trusted users and disabling the execution of .pht, .phar, and .noexe files as PHP code until a patch is applied. Restrict access to the file upload feature to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-14209

GHSA-2GCP-XWXG-HQG3

Affected Products

Dolibarr

References · 11

• 🔥 https://exploit-db.com/exploits/49711 · Exploit
• 🔥 http://packetstormsecurity.com/files/161955/Dolibarr-ERP-CRM-11.0.4-Bypass-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/GHSA-2gcp-xwxg-hqg3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14209 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-14209 · Security Note
• https://ubuntu.com/security/CVE-2020-14209 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14209 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://github.com/Dolibarr/dolibarr/releases/tag/11.0.5 · Note
• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-012 · Note