CVE-2023-33568
📋 TL;DR
This vulnerability in Dolibarr ERP/CRM software allows unauthenticated attackers to dump the entire database and access sensitive company data including customer files, prospects, suppliers, and employee information. The attack requires only that a contact file exists in the system. All organizations running vulnerable Dolibarr versions are affected.
💻 Affected Systems
- Dolibarr ERP/CRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to exposure of all business data, potential regulatory violations (GDPR, CCPA), financial fraud, and reputational damage.
Likely Case
Mass data exfiltration of customer, supplier, and employee information leading to privacy violations and potential follow-on attacks.
If Mitigated
Limited exposure if database contains minimal sensitive data or if network segmentation prevents external access.
🎯 Exploit Status
Public exploit details available on security research sites. Simple HTTP requests can trigger the database dump.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.5 or later
Vendor Advisory: https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471
Restart Required: No
Instructions:
1. Backup your database and configuration. 2. Download Dolibarr 16.0.5 or later from official site. 3. Replace vulnerable files with patched version. 4. Verify installation integrity.
🔧 Temporary Workarounds
Access Restriction
allRestrict access to Dolibarr installation via firewall rules or web server configuration.
# Example nginx location block to restrict access
location /dolibarr/ { deny all; }
# Example Apache .htaccess
Order Deny,Allow
Deny from all
Contact File Removal
allRemove all contact files if not essential for operations.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Dolibarr from internet access
- Deploy web application firewall (WAF) with rules to block database dump patterns
🔍 How to Verify
Check if Vulnerable:
Check if running Dolibarr version 16.0.0 through 16.0.4 and if contact files exist in the system.Check Version:
Check Dolibarr admin panel or view includes/main.inc.php for version informationVerify Fix Applied:
Verify Dolibarr version is 16.0.5 or later and test that database dump attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unusual database export requests
- Large data transfers from Dolibarr
- Unauthenticated access to contact-related endpoints
Network Indicators:
- HTTP requests to contact export endpoints without authentication
- Large outbound data transfers from Dolibarr server
SIEM Query:
source="dolibarr.log" AND ("export" OR "dump" OR "contact") AND status="200" AND auth="none"🔗 References
- https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7
- https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e
- https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471
- https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/1
- https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/
- https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7
- https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e
- https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471
- https://www.dolibarr.org/forum/t/dolibarr-16-0-security-breach/23471/1
- https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/
