CVE-2024-29477
📋 TL;DR
This vulnerability in Dolibarr ERP CRM allows attackers with adjacent network access to execute arbitrary code during the installation process due to insufficient input sanitization. It affects Dolibarr versions up to 19.0.0, potentially compromising the entire system.
💻 Affected Systems
- Dolibarr ERP CRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the Dolibarr server, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Attacker executes malicious code to establish persistence, steal sensitive business data, or disrupt ERP/CRM operations.
If Mitigated
Limited impact with proper network segmentation and access controls preventing adjacent attackers from reaching the installation interface.
🎯 Exploit Status
Exploitation requires network adjacency but no authentication. Public proof-of-concept exists in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 19.0.1 or later
Vendor Advisory: http://dolibarr.com
Restart Required: No
Instructions:
1. Backup your Dolibarr database and files. 2. Download latest version from dolibarr.org. 3. Replace installation files with patched version. 4. Run upgrade script if applicable.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Dolibarr installation environment from general network access
Temporary Installation Restriction
linuxRestrict access to installation interface during setup
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Dolibarr from untrusted networks
- Monitor installation logs for suspicious activity and restrict installation to specific trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check Dolibarr version in Administration > Information or examine version.php fileCheck Version:
grep '\$dolibarr_version' htdocs/includes/main.inc.php || cat htdocs/version.phpVerify Fix Applied:
Verify version is 19.0.1 or later and check that installation process validates input properly📡 Detection & Monitoring
Log Indicators:
- Unusual installation attempts from unexpected IPs
- Multiple failed installation attempts
- Suspicious input patterns during installation
Network Indicators:
- Traffic to installation endpoints from unauthorized sources
- Unexpected outbound connections post-installation
SIEM Query:
source="dolibarr.log" AND ("install" OR "setup") AND (src_ip NOT IN allowed_ips)