Vtiger CRM v7.2.0 - Directory Listing

mediumseverity

5.3CVSS score

3.4%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication.

Impact

Attackers can access sensitive files and directory structures, potentially leading to information disclosure or further exploitation.

Fix

Update to the latest version of Vtiger CRM or apply security patches that enforce proper access controls.

How to confirm it

Send: GET {{BaseURL}}/vtigercrm/libraries/ ; GET {{BaseURL}}/vtigercrm/layouts/
Positive when: status_code == 200 and contains_all(body, "Index of", "vtigercrm", "Parent Directory") and contains_any(body, "Smarty", "PHPExcel", "adodb", "nusoap", "tcpdf", "vlayout", "v7")

Run it with nuclei: nuclei -id CVE-2020-19363 -u <target>

The full check

id: CVE-2020-19363

info:
  name: Vtiger CRM v7.2.0 - Directory Listing
  author: 0x_Akoko
  severity: medium
  description: |
    Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication.
  impact: |
    Attackers can access sensitive files and directory structures, potentially leading to information disclosure or further exploitation.
  remediation: |
    Update to the latest version of Vtiger CRM or apply security patches that enforce proper access controls.
  reference:
    - https://github.com/EmreOvunc/Vtiger-CRM-Vulnerabilities
    - https://nvd.nist.gov/vuln/detail/CVE-2020-19363
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-19363
    epss-score: 0.034
    epss-percentile: 0.88948
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.html:"vtiger CRM"
    fofa-query: body="vtiger CRM"
  tags: cve,cve2020,vtiger,listing,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/vtigercrm/libraries/"
      - "{{BaseURL}}/vtigercrm/layouts/"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "Index of", "vtigercrm", "Parent Directory")'
          - 'contains_any(body, "Smarty", "PHPExcel", "adodb", "nusoap", "tcpdf", "vlayout", "v7")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from