CVE-2021-25960 SuiteCRM - CSV Injection in Accounts Module
A low-privileged attacker can inject malicious formulas into SuiteCRM account fields, leading to code execution when an administrator exports the data to CSV.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-25960?
CVE-2021-25960 is a high-severity code injection vulnerability in Salesagility Suitecrm, published on 29 Sep 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the data as a CSV file and opens it, the payload gets executed. This was not fixed properly as part of CVE-2020-15301, allowing the attacker to bypass the security measure.
Weakness: CWE-1236
Which versions are affected by CVE-2021-25960?
1 open source package ship an affected version, including suitecrm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
suitecrm Bitnami | From 7.10.29 | 7.10.32, 7.11.21 |
Products include Salesagility Suitecrm.
How do I fix CVE-2021-25960?
Upgrade suitecrm to a fixed version for your release line: 7.10.32 or 7.11.21.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-25960 being exploited?
There is no known exploitation of CVE-2021-25960 in the wild and no public exploit code.
Other vulnerabilities in Salesagility Suitecrm
Sources
Also known as BIT-suitecrm-2021-25960, GHSA-4vxw-8xm6-p5q8.