Summary
Dolibarr ERP CRM before 24.0.0 contains an OS command injection flaw in the administrative export tool. An authenticated administrator may bypass the intended command allowlist and cause operating system commands to run as the web server user when crafted export input reaches the command execution path.
Dolibarr ERP CRM before 24.0.0 contains an OS command injection flaw in the administrative export tool. An authenticated administrator may bypass the intended command allowlist and cause operating system commands to run as the web server user when crafted export input reaches the command execution path.
Affected context
The issue occurs in the administrative tools export functionality when the application constructs or invokes an operating system command involving a user-controlled mysqldump value. Risk is increased when authenticated administrators can submit export parameters, the allowlist validates only a basename or partial value, and command execution occurs with the web server account's permissions.
The issue occurs in the administrative tools export functionality when the application constructs or invokes an operating system command involving a user-controlled mysqldump value. Risk is increased when authenticated administrators can submit export parameters, the allowlist validates only a basename or partial value, and command execution occurs with the web server account's permissions.
Exploit preconditions
- Attack surface: The administrative export endpoint at
htdocs/admin/tools/export.php - Required access: An authenticated account with administrator permissions or equivalent access to the export function
- Trigger point: Processing an export request that passes a user-controlled
mysqldumpvalue into an operating system command - Why exploitation is possible: The command restriction logic can be bypassed through shell metacharacters surrounding an allowlisted command name, allowing additional command syntax to be interpreted by the operating system
- Attack surface: The administrative export endpoint at
htdocs/admin/tools/export.php - Required access: An authenticated account with administrator permissions or equivalent access to the export function
- Trigger point: Processing an export request that passes a user-controlled
mysqldumpvalue into an operating system command - Why exploitation is possible: The command restriction logic can be bypassed through shell metacharacters surrounding an allowlisted command name, allowing additional command syntax to be interpreted by the operating system
Why this happens
The vulnerability results from combining user-controlled input with shell command construction while relying on an incomplete allowlist. Validating only an executable basename does not neutralize shell control characters or ensure that the final command is safely represented as separate arguments.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, where externally influenced data can alter the structure or meaning of a command executed by the host operating system.
The vulnerability results from combining user-controlled input with shell command construction while relying on an incomplete allowlist. Validating only an executable basename does not neutralize shell control characters or ensure that the final command is safely represented as separate arguments.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, where externally influenced data can alter the structure or meaning of a command executed by the host operating system.
Potential impact
- An attacker may execute arbitrary operating system commands as the web server user.
- The application environment could be modified or disrupted.
- Database exports, credentials, or other accessible files could be disclosed.
- The host or connected services could be used for further compromise.
- Data integrity could be affected through unauthorized changes or deletion.
- An attacker may execute arbitrary operating system commands as the web server user.
- The application environment could be modified or disrupted.
- Database exports, credentials, or other accessible files could be disclosed.
- The host or connected services could be used for further compromise.
- Data integrity could be affected through unauthorized changes or deletion.
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from administrative workflows and reducing trust in request parameters.
Common defensive patterns include:
- Invoke approved executables directly with structured argument arrays rather than shell command strings.
- Use fixed internal command mappings instead of accepting executable names or command fragments from requests.
- Treat allowlists as an additional control, not as a substitute for shell-safe process execution.
- Apply strict type, format, and range validation to export parameters before they reach process APIs.
- Run the web application with a dedicated, least-privileged service account and restrict access to sensitive files and databases.
- Add authorization, audit logging, and rate controls around administrative export operations.
- Prefer application or library interfaces for database export where practical, avoiding shell-dependent wrappers.
Mitigation generally focuses on removing shell interpretation from administrative workflows and reducing trust in request parameters.
Common defensive patterns include:
- Invoke approved executables directly with structured argument arrays rather than shell command strings.
- Use fixed internal command mappings instead of accepting executable names or command fragments from requests.
- Treat allowlists as an additional control, not as a substitute for shell-safe process execution.
- Apply strict type, format, and range validation to export parameters before they reach process APIs.
- Run the web application with a dedicated, least-privileged service account and restrict access to sensitive files and databases.
- Add authorization, audit logging, and rate controls around administrative export operations.
- Prefer application or library interfaces for database export where practical, avoiding shell-dependent wrappers.
How teams detect issues like this
Detection can include static analysis for request data flowing into shell execution functions, command concatenation, interpolation, or process APIs that invoke a shell. Code review should flag allowlists that validate only command names, use of shell metacharacter filtering, and administrative parameters embedded directly in command strings.
Runtime monitoring can look for unusual child processes spawned by the web server, unexpected command-line arguments, export activity outside normal administrative patterns, and access to sensitive files following export requests. CI policies and automated security review tools can enforce structured process invocation and prohibit shell execution for untrusted input.
Detection can include static analysis for request data flowing into shell execution functions, command concatenation, interpolation, or process APIs that invoke a shell. Code review should flag allowlists that validate only command names, use of shell metacharacter filtering, and administrative parameters embedded directly in command strings.
Runtime monitoring can look for unusual child processes spawned by the web server, unexpected command-line arguments, export activity outside normal administrative patterns, and access to sensitive files following export requests. CI policies and automated security review tools can enforce structured process invocation and prohibit shell execution for untrusted input.
