CVE-2024-37821
📋 TL;DR
This vulnerability allows attackers to upload malicious .SQL files through the Upload Template function in Dolibarr ERP CRM, potentially leading to arbitrary code execution. It affects Dolibarr ERP CRM users up to version 19.0.1, putting their systems at risk of compromise.
💻 Affected Systems
- Dolibarr ERP CRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, data theft, and potential lateral movement within the network.
Likely Case
Unauthorized file upload leading to web shell deployment and limited server control.
If Mitigated
Attack blocked by file upload restrictions, with no impact on system integrity.
🎯 Exploit Status
Exploitation requires authentication to access the Upload Template function; public proof-of-concept details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v19.0.2 or later
Vendor Advisory: http://dolibarr.com
Restart Required: No
Instructions:
1. Backup your Dolibarr installation and database. 2. Download the latest version from the official Dolibarr website. 3. Replace the existing files with the updated version, ensuring to preserve custom configurations. 4. Verify the update by checking the version in the admin panel.
🔧 Temporary Workarounds
Disable Upload Template Function
allTemporarily disable the vulnerable Upload Template feature to prevent exploitation.
Edit Dolibarr configuration to remove or restrict access to the upload template module.
Implement File Upload Restrictions
linuxConfigure web server or application to block .SQL file uploads.
Add rule to .htaccess: <FilesMatch "\.sql$"> Deny from all </FilesMatch> for Apache.
🧯 If You Can't Patch
- Restrict network access to the Dolibarr instance using firewalls to limit exposure.
- Implement strict authentication and monitoring for file upload activities.
🔍 How to Verify
Check if Vulnerable:
Check the Dolibarr version in the admin panel or via the system information page; if version is 19.0.1 or earlier, it is vulnerable.Check Version:
In Dolibarr, navigate to Home > Setup > System Information to view the version.Verify Fix Applied:
After updating, confirm the version is 19.0.2 or later and test the Upload Template function with a safe file to ensure it rejects .SQL uploads.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads, especially .SQL files, in web server logs or Dolibarr audit logs.
Network Indicators:
- HTTP POST requests to upload endpoints with .SQL file extensions.
SIEM Query:
source="web_logs" AND (url="*upload*" OR method="POST") AND file_extension=".sql"