CVE-2021-42840
📋 TL;DR
SuiteCRM versions before 7.11.19 allow remote code execution via the Log File Name setting in system settings. Attackers who compromise admin accounts can set logger_file_name to point to malicious PHP files under the web root, bypassing incomplete file extension filtering. This affects all SuiteCRM installations using vulnerable versions.
💻 Affected Systems
- SuiteCRM
📦 What is this software?
Suitecrm by Salesagility
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary code, steal data, install backdoors, and pivot to other systems.
Likely Case
Web shell installation leading to data exfiltration, credential theft, and further lateral movement within the network.
If Mitigated
Limited impact with proper access controls, but still poses significant risk if admin accounts are compromised.
🎯 Exploit Status
Metasploit module available. Requires admin credentials or admin account takeover first.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.11.19 or later
Vendor Advisory: https://suitecrm.com/time-to-upgrade-suitecrm-7-11-19-7-10-30-lts-released/
Restart Required: No
Instructions:
1. Backup your SuiteCRM installation and database. 2. Download SuiteCRM 7.11.19 or later from official sources. 3. Follow upgrade instructions at https://docs.suitecrm.com/admin/installation-guide/upgrading/. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict admin access
allLimit admin account access to trusted IP addresses only
# Configure web server (Apache example) to restrict /admin path to specific IPs
<Location /admin>
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
</Location>
File extension filtering
linuxAdd additional PHP file extension filtering at web server level
# Apache: Add to .htaccess or virtual host config
<FilesMatch "\.(php|php3|php4|php5|php7|phtml|phar)$">
Deny from all
</FilesMatch>
# Then explicitly allow legitimate PHP files
🧯 If You Can't Patch
- Implement strict access controls for admin accounts with MFA and IP restrictions
- Monitor and audit all changes to system settings, particularly logger_file_name
🔍 How to Verify
Check if Vulnerable:
Check SuiteCRM version in admin panel or via config.php. Versions below 7.11.19 are vulnerable.Check Version:
grep 'suitecrm_version' config.php or check Admin → System Settings → System InformationVerify Fix Applied:
Verify version is 7.11.19 or later and check that system settings no longer accept PHP file extensions for log file names.📡 Detection & Monitoring
Log Indicators:
- Unauthorized admin logins
- Changes to logger_file_name setting
- Execution of unexpected PHP files in web root
Network Indicators:
- Unusual outbound connections from web server
- POST requests to admin settings with file path parameters
SIEM Query:
source="suitecrm.log" AND ("logger_file_name" OR "admin login" OR "system settings")🔗 References
- http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html
- https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19
- https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb
- https://suitecrm.com/time-to-upgrade-suitecrm-7-11-19-7-10-30-lts-released/
- https://theyhack.me/SuiteCRM-RCE-2/
- http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html
- https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19
- https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb
- https://suitecrm.com/time-to-upgrade-suitecrm-7-11-19-7-10-30-lts-released/
- https://theyhack.me/SuiteCRM-RCE-2/
