Reflected XSS in Dolibarr Admin Template

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in Dolibarr versions prior to 24.0.0. The 'type' parameter in the extra fields administration template is reflected without proper JavaScript escaping into an inline script block. An attacker can trick an authenticated administrator into opening a malicious URL, executing arbitrary JavaScript in their session. This could allow creating a persistent administrator account.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to Dolibarr admin pages with the 'type' parameter. Check for unusual JavaScript execution in admin sessions or unexpected administrator account creations. No specific commands are provided in the context, but inspecting web server logs for suspicious URLs containing 'type=' in admin paths may help identify exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full administrative control of your Dolibarr instance by creating a persistent administrator account. This allows them to access sensitive data, modify system configurations, and perform unauthorized actions. The attack requires tricking an administrator into clicking a malicious link.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. It may result in unauthorized data exposure, access, or modification, leading to compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Dolibarr to version 24.0.0 or later to patch the vulnerability. As a temporary measure, enable a Content Security Policy (CSP) header to block inline scripts. Review administrator accounts for unauthorized entries and restrict access to admin pages until patched.

Useful 0 Not Useful 0