// For flags

CVE-2024-50335

Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

Severity Score

4.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This can be exploited to steal CSRF tokens and perform unauthorized actions, such as creating new administrative users without proper authentication. The vulnerability arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application. When an attacker injects a malicious script, it gets executed within the context of an authenticated user's session. The injected script (o.js) then leverages the captured CSRF token to forge requests that create new administrative users, effectively compromising the integrity and security of the CRM instance. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

SuiteCRM es una aplicación de software de gestión de relaciones con los clientes (CRM) de código abierto y preparada para empresas. El campo "Clave de publicación" de la página Editar perfil de SuiteCRM es vulnerable a Cross-Site Scripting reflejado (XSS), lo que permite a un atacante inyectar código JavaScript malicioso. Esto se puede aprovechar para robar tokens CSRF y realizar acciones no autorizadas, como crear nuevos usuarios administrativos sin la autenticación adecuada. La vulnerabilidad surge debido a una validación de entrada y una limpieza insuficientes del campo Clave de publicación dentro de la aplicación SuiteCRM. Cuando un atacante inyecta un script malicioso, se ejecuta dentro del contexto de la sesión de un usuario autenticado. El script inyectado (o.js) aprovecha el token CSRF capturado para falsificar solicitudes que crean nuevos usuarios administrativos, lo que compromete de manera efectiva la integridad y la seguridad de la instancia de CRM. Este problema se ha solucionado en las versiones 7.14.6 y 8.7.1. Se recomienda a los usuarios que actualicen. No existen workarounds conocidas para esta vulnerabilidad.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-10-22 CVE Reserved
  • 2024-11-05 CVE Published
  • 2024-11-05 CVE Updated
  • 2024-11-07 First Exploit
  • 2024-11-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Salesagility
Search vendor "Salesagility"
 SuiteCRM
Search vendor "Salesagility" for product "SuiteCRM"
 < 7.14.6
Search vendor "Salesagility" for product "SuiteCRM" and version " < 7.14.6"
en
Affected
Salesagility
Search vendor "Salesagility"
 SuiteCRM
Search vendor "Salesagility" for product "SuiteCRM"
 >= 8.0.0 < 8.7.1
Search vendor "Salesagility" for product "SuiteCRM" and version " >= 8.0.0 < 8.7.1"
en
Affected