September 2017 Summaries

The Joomla! content management system has a previously unknown LDAP injection vulnerability that could allow remote attackers to leak the super user password and take over any Joomla! installation that uses LDAP for authentication, which affects installations with version 1.5 <= 3.7.5 installed and configured to use LDAP for authentication. An attacker can exploit this vulnerability by sending a row of payloads that guess the credentials character by character, allowing them to extract one bit per request from the LDAP server, resulting in a highly efficient blind LDAP injection attack. Joomla! has released a fixed version, and users are recommended to update immediately to version 3.8.

The authors analyzed the open-source edition of SugarCRM, a popular customer relationship management software, using their code analysis technology after a recent manual audit. They found several severe security vulnerabilities, including multi-step PHP object injection, blind SQL injection exploitation via CSRF, and authenticated file disclosure, which were previously missed by the vendor's manual audit. The root cause of these issues was mainly a global input sanitization function that could not enable security for all different markup contexts. If successfully exploited, these vulnerabilities potentially allow an attacker to steal customer data and sensitive files from the server, but a fixed version has been released by the SugarCRM team and updates are urged for users.