PHP Object Injection in Dolibarr Before 23.0.4

Executive Summary

Dolibarr before version 23.0.4 has a PHP object injection vulnerability in the jsonOrUnserialize() function in functions.lib.php. When json_decode() fails, the function uses unserialize() without class restrictions, allowing attackers to inject malicious serialized objects if they gain write access to specific database tables or cache directories. This can lead to gadget chains for code execution or file manipulation.

Useful 0 Not Useful 0

Detection Guidance

Check Dolibarr version with command: grep -r "version" /path/to/dolibarr/documents/ | grep -i version. If version is below 23.0.4, the system is vulnerable. Inspect functions.lib.php for jsonOrUnserialize() calls without allowed_classes parameter.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code or manipulate files on the server running Dolibarr. This requires the attacker to have write access to stored extrafields, export configurations, or blocked log entries, which may be possible through other vulnerabilities or misconfigurations.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability could impact compliance with GDPR and HIPAA if exploited to gain unauthorized access to sensitive data. PHP object injection may allow attackers to execute arbitrary code or manipulate files, potentially leading to data breaches or unauthorized data exposure. This could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dolibarr to version 23.0.4 or later. Apply the patch from Pull Request #38530 by adding allowed_classes => false to unserialize() calls in jsonOrUnserialize() and dol_readcachefile(). Restrict write access to extrafields, export configurations and blocked log entries tables.

Useful 0 Not Useful 0