CVE-2020-37082
📋 TL;DR
CVE-2020-37082 is an unauthenticated file access vulnerability in webERP 4.15.1 that allows remote attackers to download database backup files without authentication. This exposes sensitive business data including customer information, financial records, and system credentials. All organizations running the vulnerable version of webERP with internet-facing instances are affected.
💻 Affected Systems
- webERP
📦 What is this software?
Weberp by Weberp
⚠️ Risk & Real-World Impact
Worst Case
Complete database exfiltration leading to data breach, credential theft, financial fraud, and potential regulatory penalties.
Likely Case
Exposure of sensitive business data including customer PII, financial records, and internal business operations.
If Mitigated
Limited impact with proper access controls, though backup files could still contain sensitive data if accessed.
🎯 Exploit Status
Simple HTTP request to access Backup_[timestamp].sql.gz files. Exploit code available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.15.2 and later
Vendor Advisory: http://www.weberp.org
Restart Required: No
Instructions:
1. Download latest version from webERP website or SourceForge. 2. Backup current installation. 3. Replace vulnerable files with patched version. 4. Verify backup directory permissions.
🔧 Temporary Workarounds
Restrict backup directory access
allConfigure web server to deny access to companies/weberp/ directory
# Apache: Add to .htaccess or virtual host config
<Directory "/path/to/companies/weberp/">
Order deny,allow
Deny from all
</Directory>
# Nginx: Add to server block
location ~ ^/companies/weberp/ {
deny all;
return 403;
}
Change backup location
allMove backup files outside web root directory
# Edit webERP configuration to change backup path
# Look for backup configuration in config files
🧯 If You Can't Patch
- Implement strict network access controls to limit webERP access to trusted IPs only
- Regularly monitor and delete old backup files from companies/weberp/ directory
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[webERP-host]/companies/weberp/Backup_*.sql.gz - if accessible without authentication, system is vulnerable.Check Version:
Check webERP version in admin interface or look for version information in source files.Verify Fix Applied:
Verify backup files are no longer accessible via web URL and check webERP version is 4.15.2 or higher.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses for .sql.gz files in companies/weberp/ directory
- Unusual file download patterns for backup files
Network Indicators:
- HTTP GET requests to /companies/weberp/Backup_*.sql.gz from unauthorized IPs
SIEM Query:
source="web_server" AND (uri_path="/companies/weberp/Backup_" AND uri_extension=".sql.gz") AND http_status=200