CVE-2024-23817 Dolibarr Application Home Page HTML injection vulnerability
Attackers can inject HTML into the Dolibarr home page, potentially leading to Cross-Site Scripting (XSS) and content manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-23817?
CVE-2024-23817 is a high-severity cross-site scripting vulnerability in Dolibarr Dolibarr Erp\/Crm, published on 25 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.
Which versions are affected by CVE-2024-23817?
3 open source packages ship an affected version, including dolibarr/dolibarr and dolibarr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dolibarr/dolibarr Packagist | From 18.0.4 | 18.0.7 |
dolibarr/dolibarr Packagist | From 18.0.4 | 18.0.7 |
dolibarr Bitnami | From 18.0.4 | 18.0.5 |
Products include Dolibarr Dolibarr Erp\/Crm.
How do I fix CVE-2024-23817?
Upgrade dolibarr/dolibarr to 18.0.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-23817 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23817 exists.
Other vulnerabilities in Dolibarr Dolibarr Erp\/Crm
Sources
Also known as BIT-dolibarr-2024-23817, GHSA-7947-48q7-cp5m, UBUNTU-CVE-2024-23817.