Security Advisory: 1CRM Insufficient Data Protection (CVE-2020-15958)

Security researchers from aramido discovered a security vulnerability in the Customer Relationship Management system 1CRM. The all-in-one CRM software has been used by companies worldwide for over ten years for customer management, accounting, project management, sales, and marketing. In accordance with aramido's guidelines for the responsible disclosure of security vulnerabilities , aramido reported the vulnerability to the manufacturer for remediation, which according to 1CRM's German distribution partner, Visual4 GmbH, has since taken place. The security advisory formulated by aramido can be viewed publicly.

Unauthorized third parties could have downloaded sensitive files from the CRM system

The security researchers were able to determine that unauthenticated users had access to stored files in the root directory of the web server due to incomplete permission checks. Depending on the module used, attackers would have been able to access orders, invoices, and CVs. In particular, data backups could be downloaded without authorization with little effort due to a predictable file naming convention. These data backups contain a complete dump of the database, configurations, passwords, and also files uploaded to the system.

Operators of 1CRM systems should apply the provided update as soon as possible

1CRM urges all cloud and on-premise customers to apply the update to version 8.6.7 or newer. In general, aramido recommends performing hardening measures when operating web applications based on standard software. For example, the basic settings for the application can be adjusted at the web server configuration level so that the own IT systems are secured against attacks like this. Additionally, it is advised to operate systems with particularly sensitive data in an intranet and make them available via a VPN.

Missing permission checks were the cause of the vulnerability

All uploaded files of the CRM are stored in folders within the root directory of the web server (web root). In addition, database backups, application configurations, file attachments, and modules are stored there. It was possible to access files in the root directory through an insecure direct object reference. Requests for such files are not processed by the 1CRM application but are answered by the web server itself. The file names must be known to the user for a successful access - but 1CRM follows a predictable folder structure such as /files/upload/42/ and the file names of many sensitive files are easy to guess. For example, backup files can be downloaded by systematically trying the timestamps contained in the file name.

Detecting unauthorized file access by checking logs

To recognize whether the vulnerability has already been exploited, operators of 1CRM on-premise solutions should examine the web server logs for anomalies. An indication could be a cluster of unsuccessful accesses caused by trying different file names. Likewise, it should be checked whether access to sensitive files such as backups was made from unknown IP addresses.

If the web server logs are no longer available, passwords should be changed as a precautionary measure. In individual cases, data protection legal steps must be discussed.

The manufacturer should implement a proper access control for remediation

aramido recommends that application manufacturers always store sensitive data outside the root directory of the web server. In addition, proper access control must be implemented so that data is only delivered to authorized users. Furthermore, aramido advises against saving documents with arbitrarily chosen file names in the file directory. A random file name can be chosen so that it is difficult to guess and also only contains secure characters for operating or file systems. In addition, due to potential negative effects of a leak, backup files should always be encrypted.

The security vulnerability was reported by aramido to 1CRM Systems Corp and the German distribution partner Visual4 on July 27, 2020. The vulnerability was assigned CVE-2020-15958. Visual4 reported the remediation of the security vulnerability on August 27, 2020, and had already informed its customers in advance. Information about the concrete remediation or a snapshot of the latest version was not provided, meaning that the remediation could not yet be verified by aramido.