CVE-2024-50333
Improper Input Validation (CWE-20)
Summary
SuiteCRM, an open-source Customer Relationship Management (CRM) software, has a vulnerability where user input is not properly validated and can be written to the filesystem. Specifically, the ParserLabel::addLabels() function can be exploited to write attacker-controlled data into the custom language file, which is then included at runtime.
Impact
This vulnerability allows an attacker with low privileges to potentially execute arbitrary code or commands on the affected system. The attacker can manipulate the custom language file, which is included at runtime, potentially leading to remote code execution. This could result in unauthorized access to sensitive data, system compromise, or disruption of services. The vulnerability has a high impact on the confidentiality, integrity, and availability of the affected system.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
Patches are available. The vulnerability has been addressed in SuiteCRM versions 7.14.6 and 8.7.1. Users are advised to upgrade to these or later versions to mitigate the risk.
Mitigation
1. Upgrade SuiteCRM to version 7.14.6 or 8.7.1, depending on your current major version. 2. If immediate upgrade is not possible, implement strict input validation and sanitization for all user inputs, especially those that interact with the filesystem or language files. 3. Apply the principle of least privilege, limiting user access rights to the minimum necessary for their roles. 4. Monitor system logs for any suspicious activities related to file system writes or language file modifications. 5. Implement network segmentation to limit the potential impact if the vulnerability is exploited. 6. Regularly audit and review custom language files for any unauthorized modifications.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-50333
A CVSS base score of 6.6 has been assigned.
Feedly found the first article mentioning CVE-2024-50333. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 10%)
A CVSS base score of 8.8 has been assigned.