Executive Summary

This vulnerability is a persistent cross-site scripting (XSS) flaw in Dolibarr version 11.0.3, specifically in the LDAP synchronization settings handled by the /dolibarr/admin/ldap.php script. Attackers can inject malicious JavaScript code through multiple parameters such as host, slave, and port. The injected script persists and executes in the context of the web application, allowing attackers to run arbitrary JavaScript. This can lead to actions like stealing user cookies and session information. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers to execute arbitrary JavaScript code within the affected application, potentially leading to theft of user cookies and session hijacking. This can compromise user accounts and allow unauthorized access or actions within the application. The persistent nature of the XSS means the malicious script remains active and can affect multiple users. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP POST requests to the /dolibarr/admin/ldap.php endpoint with the action parameter set to 'setvalue'. Specifically, look for suspicious payloads injected into the 'host', 'slave', or 'port' parameters containing encoded SVG content with embedded JavaScript. A practical detection method is to capture and inspect POST requests for base64-encoded SVG payloads or unusual script tags within these parameters. For example, using curl or similar tools, you can attempt to reproduce the injection payload to verify if the system is vulnerable. Additionally, web application firewalls (WAF) or intrusion detection systems (IDS) can be configured to alert on such patterns. Example command to test injection (replace URL accordingly): curl -X POST -d "action=setvalue&host=<payload>" https://your-dolibarr-instance/dolibarr/admin/ldap.php [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /dolibarr/admin/ldap.php page to trusted administrators only, applying input validation and sanitization on the 'host', 'slave', and 'port' parameters to prevent script injection, and updating Dolibarr to a version where this vulnerability is fixed if available. Additionally, monitoring and blocking suspicious POST requests containing script payloads can help reduce risk. If a patch is not yet available, consider disabling LDAP synchronization settings temporarily to prevent exploitation. [1, 2]

Useful 0 Not Useful 0