PT-2022-16354 · Suitecrm · Suitecrm

Manuelz120 · Published 2022-03-07 · Updated 2024-03-06 · CVE-2022-23940

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.12.2 and 8.0.2

Description The issue allows remote code execution. Authenticated users with access to the Scheduled Reports module can exploit this by leveraging PHP deserialization in the email recipients property. They can create a malicious report containing a PHP-deserialization payload in the email recipients field. Once someone accesses this report, the backend will deserialize the content of the email recipients field and the payload gets executed. Project dependencies include PHP deserialization gadgets that can be used for code execution.

Recommendations For SuiteCRM versions prior to 7.12.2, update to version 7.12.2 or later to resolve the issue. For SuiteCRM version 8.0.1, update to version 8.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Scheduled Reports module until a patch is available. Avoid using the email recipients field in the Scheduled Reports module until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-SUITECRM-2022-23940

CVE-2022-23940

Affected Products

Suitecrm

References · 6

• 🔥 https://github.com/manuelz120/CVE-2022-23940 · Exploit
• 🔥 https://github.com/manuelz120 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23940 · Security Note
• https://osv.dev/vulnerability/BIT-suitecrm-2022-23940 · Vendor Advisory
• https://docs.suitecrm.com/8.x/admin/releases/8.0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23940 · Vendor Advisory