Dolibarr 23.0.2 Security Update: SSRF and File Handling Vulnerabilities Fixed

Dolibarr 23.0.2 Security Update Summary Vulnerability Overview This release (23.0.2) includes multiple security fixes and permission improvements, primarily addressing the following critical vulnerabilities: 1. SSRF (Server-Side Request Forgery): ID: Description: Fixes an SSRF vulnerability potentially present in the Webhook functionality, preventing malicious requests. 2. File Handling/Upload Vulnerability: ID: Description: Disables and sanitizes deprecated file functions to prevent potential file operation risks. 3. Security Audit Fix: ID: Description: Security audit fix from Sec4check (Credit: Grzegorz Tworek, Sec4check), specifically addressing internal logic or permission corrections. 4. Docker Deployment Security: ID: Description: Fixes multiple issues within demo Docker packages, providing a more secure deployment method. 5. API Permission/Authentication Issues: ID: Description: Fixes an issue where the API returns a 401 error when fetching a Warehouse by ID, involving permission validation logic. 6. Accounting Module Permissions: ID: Description: Improves permission controls when creating and exporting accounting entries (Use better rights on create / export entry). Affected Scope The affected systems are all users of Dolibarr ERP/CRM, particularly in scenarios involving: Configuring and using Webhook functionality. Operations involving file loading or saving. Deploying Dolibarr environments via Docker. Calling Dolibarr API endpoints. Creating or exporting entries using the Accountancy module. Remediation Upgrade Version: Upgrade the Dolibarr system to version 23.0.2. Recommendations: After upgrading, it is recommended to review Webhook configurations, API call permissions, and Docker deployment settings to ensure compliance with new security standards. (Note: This page does not contain specific POC code or exploit code; it only provides fix descriptions.)*

Goal Reached Thanks to every supporter — we hit 100%!

Dolibarr 23.0.2 Security Update: SSRF and File Handling Vulnerabilities Fixed

More from this source