CVE-2023-49508

Vulnerability

A directory traversal vulnerability exists in YetiForceCRM versions 6.4.0 and earlier in the LibraryLicense.php component. The license parameter is insufficiently sanitized, allowing an attacker to include path traversal sequences (e.g., ../) [1]. The commit diff shows that the input was originally processed as 'Text' type without proper directory validation [3].

Exploitation

Exploitation requires a remote authenticated user. An attacker can send a crafted HTTP request with a malicious license parameter to read arbitrary files outside the intended directory. No special privileges beyond basic authentication are needed [2].

Impact

Successful exploitation allows reading sensitive files such as configuration files (e.g., database credentials), source code, or other system files. This information disclosure can facilitate further attacks against the application and underlying infrastructure [1][2].

Mitigation

The vulnerability was patched in commit ba3a348, which introduced proper file path validation using \App\Fields\File::isAllowedFileDirectory and output escaping. The fix is included in version 6.4.271 and later. Users should upgrade to a patched version [3]. The original repository has been archived [4].