CVE-2022-23940
Published: 10 March 2022
Summary
CVE-2022-23940 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Salesagility Suitecrm. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SuiteCRM through version 7.12.1 and 8.x through 8.0.1 contains a remote code execution vulnerability that arises from unsafe PHP deserialization of the email_recipients property inside the Scheduled Reports module. The affected component accepts attacker-controlled serialized data that is later deserialized during report access, and the application ships with several deserialization gadget chains from dependencies such as Monolog that can be chained for arbitrary code execution.
An authenticated user who has access to the Scheduled Reports module can create a malicious report containing a crafted payload in the email_recipients field. When any user or scheduled process subsequently views or processes the report, the backend deserializes the field and executes the payload, resulting in remote code execution with the privileges of the web application process.
The referenced SuiteCRM 8.0 release documentation indicates that the issue is resolved in versions after 8.0.1. The EPSS score has remained flat at its peak value of 0.4487 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28859
Vulnerability details
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a…
more
malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.