Executive Summary

This vulnerability exists in EspoCRM versions prior to 9.3.4. It involves the built-in formula scripting engine that allows an authenticated admin user to overwrite the sourceId field on Attachment entities.

Because the sourceId value is concatenated directly into a file path without any sanitization in the EspoUploadDir::getFilePath() function, an attacker can manipulate this to redirect file read or write operations to arbitrary paths within the web server's open_basedir scope.

This means an attacker with admin privileges can potentially access or modify files outside the intended directories, leading to serious security risks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have severe impacts including unauthorized reading or writing of files within the web server's allowed directory scope.

• Confidential data exposure by reading sensitive files.
• Data integrity compromise by overwriting or modifying files.
• Potential for further exploitation by manipulating files critical to the application or server.

Overall, it can lead to a complete compromise of confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade EspoCRM to version 9.3.4 or later, as this version fixes the issue.

Useful 0 Not Useful 0