Executive Summary

This vulnerability exists in SuiteCRM versions prior to 7.15.1 and 8.9.3 in the ModuleBuilder module. The function action_exportCustom does not properly neutralize path traversal sequences in the parameters $modules and $name. These parameters are then used to construct file paths for reading and writing in the exportCustom function. As a result, a user with access to the ModuleBuilder module, typically an administrator, can craft a request that copies the contents of any readable directory on the host system into the web root, making those files accessible via the web.

This means an attacker can potentially expose sensitive system files such as those in /etc or the root directory of the web server, including secrets and environment variables.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with ModuleBuilder access to copy any readable directory from the server into the web root, exposing sensitive files to unauthorized users.

• Exposure of system files such as configuration files, environment variables, and secrets.
• Potential leakage of sensitive information that could be used for further attacks.
• Compromise of confidentiality due to unauthorized file disclosure.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SuiteCRM to version 7.15.1 or later if you are using the 7.x branch, or to version 8.9.3 or later if you are using the 8.x branch.

Restrict access to the ModuleBuilder module to only trusted administrators, as exploitation requires access to this module.

Useful 0 Not Useful 0