Published: Wed, 31 Aug 2016 17:51:23 -0700
CiviCRM includes a handful of backend scripts (bin/migrate/*.php and bin/encryptDB.php) which facilitate some special workflows (such as migrating site-configurations and obfuscating the database). These scripts include security protections, but -- depending on your organizational policies -- these protections may be inadequate. CiviCRM v4.7.11+ tightens access to these scripts.
Who is impacted?
In older versions, the security of these scripts rests on three things: a username, a password, and the site-key.
Published: Wed, 31 Aug 2016 16:20:09 -0700
An automated security audit (based on static code analysis of the CiviCRM codebase) indicated that a dependency (PEAR CLI from the "packages" folder) could potentially reveal semi-sensitive backtrace data if an attacker could run it and provoke an error.
An exploit of this has not been identified.
As a precautionary measure, CiviCRM v4.7.11 removes PEAR CLI.
Published: Thu, 25 Aug 2016 14:56:45 -0700
CiviCRM allows users to import contacts using CSV or SQL. Prior to 4.7.11 (or 4.6.21), the permission "import contacts" allowed users to import by any means -- either CSV or SQL. A user with this permission could use it to bypass ACL rules. Beginning with 4.7.11+ (or 4.6.21+), there is now a separate permission "import SQL datasource". If you want your users to be able to import contacts using SQL, you must now grant both permissions ("import contacts" and "import SQL datasource").
Published: Tue, 23 Aug 2016 15:55:44 -0700
CiviCRM previously did not set secure flags to restrict cookies to SSL where appropriate. This was not a security risk by itself, but the change is being made and notified in security release information as part of a wider "defense in depth" process within CiviCRM.
Published: Tue, 23 Aug 2016 15:19:47 -0700
A SQL injection vulnerability in CiviCRM's API was identified, where an API parameter was identified as being passed directly to SQL.
This is mitigated by the fact that the remote user must have some elevated permissions to exploit the vulnerability. CiviCRM recommends that all sites upgrade to obtain this and other recent fixes.
Published: Wed, 01 Jun 2016 14:26:10 -0700
An access bypass was identified where if a user was permitted only the "View own contact" permission in the CMS, they were also able to edit their own contact. This bypass of permissions checking did not extend to other contacts in CiviCRM.
Published: Wed, 01 Jun 2016 14:13:36 -0700
A potential for information disclosure was identified in a packaged library, HTML TreeBuilder.
CiviCRM now patches the TreeBuilder library to direct debug output to the CiviCRM debug log, rather than to screen.
Published: Tue, 03 May 2016 14:39:22 -0700
This release addresses an issue where it was possible to deliver a cross-site scripting attack through the CiviCRM backend.
To exploit this vulnerability, both the attacker and victim need permission to access the CiviCRM backend, and the victim must visit a specific screen.
For more information about this type of vulnerability, see OWASP's page on Cross Site Scripting.
Published: Tue, 03 May 2016 14:16:01 -0700
Multiple SQL injections have been identified in AJAX helpers supporting backend forms. An exploit has been demonstrated. Executing an exploit requires a user account with some kind of CiviCRM permission (such as "access CiviCRM" or "view my contact").
Published: Tue, 01 Mar 2016 18:58:55 -0800
A bundled library, TCPDF, had a recent security flaw patched. This vulnerability permitted a malicious user to make the PDF library perform unexpected actions, potentially permitting data disclosure. This was mitigated by the fact that only administrative users have access to the PDF generation functionality which uses TCPDF.
Published: Mon, 29 Feb 2016 12:38:28 -0800
In some configurations, a malicious backend user may be able to impersonate another backend user. Some conditions must be met to be exploitable:
-
The malicious backend user must already have write-access to the target user's contact record.
-
The malicious backend user must know the CIVICRM_SITE_KEY.
Published: Tue, 02 Feb 2016 02:17:13 -0800
The CiviCRM installer was potentially vulnerable to SQL injection.
Published: Tue, 02 Feb 2016 02:12:04 -0800
The 4.6.11 release of CiviCRM addresses multiple vulnerabilities in DOMPDF, a library used within CiviCRM to generate PDFs.
For more information, see the DOMPDF release notes for DOMPDF v0.6.2
Published: Tue, 02 Feb 2016 02:06:38 -0800
The 4.6.11 release of CiviCRM addresses an issue whereby users with limited administrative rights (data viewing) were able to modify certain fields within CiviCRM.
Published: Tue, 02 Feb 2016 01:58:56 -0800
The 4.6.11 release of CiviCRM addresses an issue whereby directly accessing certain CiviCRM files could reveal the full path of the active CiviCRM installation.
This is Full Path Disclosure and while not directly exploitable, in combination with other attacks it may weaken the security of an installation.
For more information on this type of vulnerability, see OWASP's page on Full Path Disclosure.
Published: Tue, 03 Nov 2015 12:40:25 -0800
This release addresses an issue where it was possible to deliver XSS by directing a user to a CiviCRM URL which triggered a fatal error. The issue has been addressed by correctly escaping output from CiviCRM's fatal error handler.
For more information about this type of vulnerability, see OWASP's page on Cross Site Scripting.
Published: Mon, 02 Nov 2015 12:56:46 -0800
The CiviCRM footer may have been displayed to users without "access CiviCRM" permission under certain conditions. The footer shows limited version information and upgrade notifications, which could be used by an attacker to identify vulnerabilities based on whether the installed version is up-to-date.
Published: Sun, 27 Sep 2015 19:26:20 -0700
There was a bug in one of CiviCRM's internal type checks which may allow inappropriate user input to be saved to the database and/or displayed.
This was a general weakness in one of CiviCRM's security layers; no specific exploits of this have been identified. This type of vulnerability could potentially allow attackers to save malicious content to the database or display it to site users.
Published: Wed, 26 Aug 2015 14:46:21 -0700
CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites.
The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “view all contacts”. Changes introduced in CRM-16512 allowed the “view my contact” permission for those users to incorrectly grant access to all contacts.
Published: Wed, 19 Aug 2015 05:09:55 -0700
The contribution page's return URL could be used to redirect site visitors to another URL.
For more information about this type of attack, see OWASP's reference page on open redirects.
Published: Wed, 19 Aug 2015 05:01:36 -0700
This release addresses an issue where it was possible to deliver XSS by directing a user to a CiviCRM URL which triggered a fatal error. The issue has been addressed by correctly escaping output from CiviCRM's fatal error handler.
For more information about this type of vulnerability, see OWASP's page on Cross Site Scripting.
Published: Wed, 04 Mar 2015 12:15:51 -0800
The backend CiviMail composition screen includes an input field which is passed to a SQL query without proper escaping.
An exploit of this vulnerability in CiviCRM has not been identified. Additional filters apply to the field which block a number of SQL control characters. Never-the-less, it could potentially be combined with other vulnerabilities, and we're issuing a patch as a precaution.
Published: Wed, 04 Mar 2015 12:05:03 -0800
The Smarty templating engine includes a defect in which a specially named Smarty template could be used to execute PHP code.
An exploit of this vulnerability in CiviCRM has not been identified. Exploiting it requires that an attacker have permission to set the name and content of a template file; in CiviCRM deployments, this permission is generally only available to system administrators. Never-the-less, it could potentially be combined with other vulnerabilities, and we're issuing a patch as a precaution.
Published: Sat, 28 Feb 2015 22:02:23 -0800
By default, CiviCRM records log entries in a flat text file. Optionally, log entries may be directed to Drupal's watchdog() service. If this option is enabled, and if a log entry includes user-supplied data, the user-supplied data may not be correctly encoded. When an administrator browses the log entries, they may be exposed to a cross-site scripting attack.
Published: Sat, 28 Feb 2015 21:20:08 -0800
Cross-Site Scripting (XSS) is a technique used to embed malicious content into the resulting web page. As such, it is pertinent to note that this class of attack targets end-users rather than the web application itself. When this attack is considered “reflected”, a user requests a web page with a payload which is embedded within a crafted hyperlink or a malicious page.
Certain AJAX callbacks in CiviCRM did not properly encode their outputs - making them vulnerable to cross-site scripting attacks.