Description
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dolibarr | dolibarr | < 24.0.0 | 24.0.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | No fix yet | — |
References
- Patch Commit patch
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/admin/tools/export.php#L129-L154 technical-description
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/core/class/utils.class.php#L322-L327 technical-description
- https://github.com/Dolibarr/dolibarr product
- VulnCheck Advisory: Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter third-party-advisory