A vulnerability has been discovered in SugarCRM that allows logged in users to bypass restrictions of their list privilege, allowing to list all entries. This vulnerability enables logged-in users to see the names of customers and contact persons, they are not allowed to see. They however are not able to otherwise access customer or contact person entries, such as viewing their details. Thus the risk of this vulnerability is
estimated as medium. The risk in a particular case varies depending on the actual confidentiality of customer relationships.
Vulnerable Systems:
* SugarCRM Community Edition prior to version 6.1.2
* SugarCRM Professional prior to version 6.1.2
* SugarCRM Enterprise prior to version 6.1.2
Immune Systems:
* SugarCRM Community Edition version 6.1.3
* SugarCRM Professional version 6.1.3
* SugarCRM Enterprise version 6.1.3
SugarCRM supports defining so-called roles, that have a given set of privileges for each object type, such as customers (called "accounts"), calls and opportunities. A role can then be assigned to users, to which the defined privileges apply.
These privileges, among others, include View, Edit, Delete and List. The List privilege controls to what extent a list of existing objects can be accessed. It may be set to All, Owner or None. When set to Owner, users to which this applies can only see the objects they own, such as customers assigned to them.
When trying to create, for example, a new customer, SugarCRM performs a duplicate check and warns the user, if a customer using the same name already exists. The warning page includes a listing of the conflicting entries, regardless of their owner. Furthermore, when reloading the page at this point, it shows a complete list of all customers, even if the user's List privilege is limited to Owner. Directly accessing the URL of this page works in the same way. This likewise applies to contact entries, too.
Proof of Concept:
The following URL displays a list of all customers ("accounts"):
http://www.example.org/sugarcrm/index.php?module=Accounts&action=ShowDuplicates
The following URL displays a list of all contacts:
http://www.example.org/sugarcrm/index.php?module=Contacts&action=ShowDuplicates
