CVE-2024-50333
📋 TL;DR
SuiteCRM has an input validation vulnerability in the ParserLabel::addLabels() function that allows attackers to write arbitrary data to custom language files. This can lead to remote code execution when the malicious files are included at runtime. All SuiteCRM users running vulnerable versions are affected.
💻 Affected Systems
- SuiteCRM
📦 What is this software?
Suitecrm by Salesagility
Suitecrm by Salesagility
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Arbitrary file write leading to web shell deployment, data manipulation, or denial of service.
If Mitigated
Limited impact with proper input validation and file system permissions restricting write access.
🎯 Exploit Status
Exploitation requires authenticated access to the SuiteCRM application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.14.6 or 8.7.1
Vendor Advisory: https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-qrv6-3q86-qv89
Restart Required: No
Instructions:
1. Backup your SuiteCRM installation and database. 2. Download the patched version (7.14.6 or 8.7.1). 3. Replace vulnerable files with patched versions. 4. Clear application cache if applicable.
🧯 If You Can't Patch
- Restrict file system write permissions for the web server user to custom language directories.
- Implement web application firewall rules to detect and block suspicious file write attempts.
🔍 How to Verify
Check if Vulnerable:
Check SuiteCRM version in admin panel or by examining the application files. Versions below 7.14.6 or 8.7.1 are vulnerable.Check Version:
Check the version.php file in the SuiteCRM root directory or use the admin panel's about page.Verify Fix Applied:
Verify the version number shows 7.14.6 or higher for SuiteCRM 7.x, or 8.7.1 or higher for SuiteCRM 8.x.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations to custom language directories
- Multiple failed authentication attempts followed by successful login and file modifications
Network Indicators:
- HTTP POST requests to ParserLabel-related endpoints with suspicious payloads
SIEM Query:
source="suitecrm.log" AND ("addLabels" OR "ParserLabel" OR "custom/language") AND ("write" OR "file_put_contents")