CVE-2024-31503
📋 TL;DR
This vulnerability allows authenticated attackers in Dolibarr ERP CRM to steal session cookies and CSRF tokens from other users through crafted web pages. This can lead to complete account takeover of victim users. All users of Dolibarr versions 19.0.0 and earlier are affected.
💻 Affected Systems
- Dolibarr ERP CRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of any user, including administrators, leading to data theft, privilege escalation, and system compromise.
Likely Case
Attackers steal session cookies to impersonate users, accessing sensitive business data and performing unauthorized actions.
If Mitigated
With proper session management and CSRF protections, impact limited to temporary session hijacking without persistent access.
🎯 Exploit Status
Exploit requires authenticated attacker and social engineering to trick users into visiting malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.0.1 or later
Vendor Advisory: https://github.com/Dolibarr/dolibarr/security/advisories
Restart Required: No
Instructions:
1. Backup your Dolibarr installation and database. 2. Download latest version from official repository. 3. Replace files with patched version. 4. Clear browser caches and sessions.
🔧 Temporary Workarounds
Session hardening
allImplement strict session management and cookie security headers
Set session.cookie_httponly=1 in php.ini
Set session.cookie_secure=1 if using HTTPS
CSRF token validation
allEnforce CSRF token validation on all state-changing requests
🧯 If You Can't Patch
- Implement web application firewall rules to detect and block session cookie theft attempts
- Monitor for unusual session activity and implement session timeouts
🔍 How to Verify
Check if Vulnerable:
Check Dolibarr version in admin panel or by examining version.php fileCheck Version:
grep '\$version' htdocs/includes/version.phpVerify Fix Applied:
Verify version is 19.0.1 or later and test CSRF protection functionality📡 Detection & Monitoring
Log Indicators:
- Multiple session creations from same IP
- Session ID reuse across different user agents
- CSRF token validation failures
Network Indicators:
- Unusual redirects to external domains
- Suspicious JavaScript injection attempts
SIEM Query:
source="dolibarr.log" AND ("session hijack" OR "CSRF token" OR "cookie theft")