Reflected HTML Injection in CRM Software

As security researchers from aramido found, the login page of the web-based CRM system CRM+ by Brainformatik GmbH had a vulnerability for reflected HTML injections. This is a security vulnerability that repeatedly occurs on websites with input fields, although it has long been considered one of the most common security risks for web applications . In accordance with our process for the responsible disclosure of security vulnerabilities , aramido reported the vulnerability to the manufacturer for remediation, which according to Brainformatik GmbH has since taken place. The security advisory formulated by aramido can also be viewed publicly.

On the login page of CRM+ version 4.1, there was a form that contained several hidden input fields. One of these hidden fields was named forward_action; its values could be controlled via the action parameter, which enabled an HTML injection. Although the application filtered the action parameter, it was possible to inject HTML tags such as a, div or img. The URL to the manipulated website could then have been sent to people with a CRM+ account. Attackers could have used this to attempt to obtain their username or password, or to redirect users to websites other than the CRM+ website.

To remediate a vulnerability of this type, it is necessary to improve at the following levels:

1. Validation of all user inputs with appropriate error handling.
2. Escaping all variable contents according to the target system, for example HTML or JavaScript output.
3. Formulation of a Content Security Policy (CSP) .

CRM+ is a web-based system for managing customer relationships, which, according to the manufacturer, provides the desired information in a structured and process-oriented manner, regardless of time and location. The documented vulnerability was detected in version 4.1 of CRM+. Customers of Brainformatik GmbH are urged to upgrade their instance of CRM+ to the current version. Furthermore, aramido recommends performing hardening measures , i.e., further securing the own IT system against the attack described here and, for example, making the login page of CRM+ reachable only from the internal network.