SugarCRM on Apache / Windows .htaccess Direct Request Arbitrary File Access

medium Nessus Plugin ID 42962

Language:

Synopsis

A web application on the remote host has an information disclosure vulnerability.

Description

The version of SugarCRM running on the remote host has an information disclosure vulnerability. When Apache is running on Windows, .htaccess restrictions are case-sensitive, but filenames are not. A remote attacker can bypass .htaccess restrictions by using uppercase letters when requesting files that should be restricted. The information gathered from restricted files could be used to mount further attacks.

There are reportedly other vulnerabilities in this version of SugarCRM, though Nessus has not checked for those issues.

Solution

Upgrade to SugarCRM 5.2.0k / 5.5.0.RC4 or later.

If SugarCRM is running on Apache 1.3.x (which is still affected by this issue), use the referenced vendor workaround.

Plugin Details

Severity: Medium

ID: 42962

File Name: sugarcrm_apache_win_htaccess_bypass.nasl

Version: 1.12

Type: remote

Family: CGI abuses

Published: 12/1/2009

Updated: 6/1/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

Required KB Items: www/sugarcrm

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/28/2009

Vulnerability Publication Date: 11/22/2009

Reference Information

BID: 37136

Secunia: 37464

Detections

Analytics