CVE-2021-42840: Malicious File Upload
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42840?
CVE-2021-42840 is a vulnerability in SuiteCRM before version 7.11.19 that allows remote code execution through a system settings Log File Name setting.
How severe is CVE-2021-42840?
CVE-2021-42840 has a severity rating of 8.8 (Critical).
Which software versions are affected by CVE-2021-42840?
SuiteCRM versions up to and exclusive of 7.11.19 are affected by CVE-2021-42840.
How can an attacker exploit CVE-2021-42840?
An attacker can exploit CVE-2021-42840 by taking over an admin account and then using the logger_file_name setting to reference an attacker-controlled PHP file under the web root.
Are there any references available for CVE-2021-42840?
Yes, you can find references for CVE-2021-42840 at the following links: [Packet Storm](http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html), [SuiteCRM Documentation](https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19), [Metasploit Framework](https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb).