CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 contains a vulnerability where users with the 'Setup documents directories' permission can rename uploaded files to have insecure file extensions (e.g., .php, .html). This bypasses the .noexe protection mechanism, which is intended to prevent execution of uploaded files by blocking dangerous extensions [2].

To exploit this, an authenticated user must have the 'Setup documents directories' permission, typically assigned to administrators or document managers. The attacker uploads a file with a benign extension (e.g., .txt) and then renames it to a dangerous extension like .php or .html. If the file is served with executable content, it can lead to cross-site scripting (XSS) attacks [2].

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Dolibarr application, potentially stealing session cookies, defacing the site, or performing actions on behalf of other users. The vulnerability is a medium-severity issue that requires specific privileges but can lead to further compromise of the system.

As of the publication date, the vulnerability affects Dolibarr 11.0.4. Users should upgrade to a patched version if available. Administrators should review permissions and restrict the 'Setup documents directories' privilege to trusted users only [1]. No workaround is documented, but limiting file rename capabilities may reduce risk.