CVE-2023-38888
📋 TL;DR
This is a Cross-Site Scripting (XSS) vulnerability in Dolibarr ERP CRM's REST API module that allows remote attackers to inject malicious scripts. When exploited, it can lead to sensitive information disclosure and arbitrary code execution. Affects Dolibarr versions 17.0.1 and earlier.
💻 Affected Systems
- Dolibarr ERP CRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution, data theft, and potential lateral movement within the network.
Likely Case
Session hijacking, credential theft, and unauthorized access to sensitive business data stored in the ERP system.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting individual user sessions.
🎯 Exploit Status
Exploitation requires access to the REST API endpoint; detailed technical analysis available in the AKERVA advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.0.2 or later
Vendor Advisory: http://dolibarr.com
Restart Required: No
Instructions:
1. Backup your Dolibarr installation and database. 2. Download the latest version from the official Dolibarr website. 3. Replace the existing installation files with the patched version. 4. Clear any caches if applicable.
🔧 Temporary Workarounds
Disable REST API Module
allTemporarily disable the vulnerable REST API module to prevent exploitation.
Navigate to Dolibarr admin panel > Modules/Applications > Disable 'Web Services' module
Implement WAF Rules
allAdd specific Web Application Firewall rules to block XSS payloads targeting the REST API endpoints.
Add WAF rule: Detect and block patterns like <script>, javascript:, and common XSS payloads in REST API requests
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all REST API endpoints
- Restrict network access to Dolibarr instances using firewall rules or network segmentation
🔍 How to Verify
Check if Vulnerable:
Check Dolibarr version in admin panel or via the /admin/about.php endpoint; versions 17.0.1 or earlier are vulnerable.Check Version:
Check Dolibarr admin panel or examine the main.inc.php configuration file for version information.Verify Fix Applied:
Verify version is 17.0.2 or later and test REST API endpoints with XSS payloads to confirm they're properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual REST API requests containing script tags or JavaScript code
- Multiple failed authentication attempts followed by successful REST API access
Network Indicators:
- HTTP requests to REST API endpoints with suspicious parameters containing script elements
SIEM Query:
source="dolibarr.log" AND ("REST" OR "api") AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")