PT-2024-34148 · Suitecrm · Suitecrm

Shellkraft · Published 2024-11-05 · Updated 2024-11-08 · CVE-2024-50335

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.6 SuiteCRM versions prior to 8.7.1

Description: The issue arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application, allowing an attacker to inject malicious JavaScript code. This can be exploited to steal CSRF tokens and perform unauthorized actions, such as creating new administrative users without proper authentication. When an attacker injects a malicious script, it gets executed within the context of an authenticated user's session. The injected script then leverages the captured CSRF token to forge requests that create new administrative users, effectively compromising the integrity and security of the CRM instance.

Recommendations: For versions prior to 7.14.6, upgrade to version 7.14.6 or later. For versions prior to 8.7.1, upgrade to version 8.7.1 or later. As a temporary workaround, consider restricting access to the Publish Key field in the Edit Profile page until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-SUITECRM-2024-50335

CVE-2024-50335

GHSA-8RW6-G96J-3W7M

Affected Products

Suitecrm

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50335.json · Exploit
• https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-8rw6-g96j-3w7m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50335 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50335 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-suitecrm-2024-50335 · Vendor Advisory
• https://t.me/cvedetector/9935 · Telegram Post
• https://twitter.com/CVEnew/status/1853873258954678610 · Twitter Post