February 2024 - devel - lists.freelock.com

Bug#1062845: ledgersmb: CVE-2024-23831
by Salvatore Bonaccorso 26 Jul '24

26 Jul '24

Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-2+deb11u3 Hi, The following vulnerability was published for ledgersmb. CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-q… [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c012… Regards, Salvatore

2 1

LedgerSMB 1.9.28 released
by Erik Huelsmann 10 Jul '24

10 Jul '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.28 * Fix deletion of parts groups (#7363) * Align invoice/order entry between databases with and without parts (#7374) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.28/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.28 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.28 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.9.28 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.28 These are the sha256 checksums of the uploaded files: 4b2c0c53de2d80f5fc5ec3f8ee3bea61e5624684ebb1c2d55b2c2472c904a5b4 ledgersmb-1.9.28.tar.gz ccad27a8f22c25bbea0c5fdef564df325e9c202bd95af5713c4f8c14038b0f49 ledgersmb-1.9.28.tar.gz.asc

1 0

LedgerSMB 1.9.29 released
by Erik Huelsmann 10 Jul '24

10 Jul '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.9.29 * Fix regression since 1.9.27 upgrading old companies while renaming setting * Fix selection of default AR/AP accounts while importing databases (#7419) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.9.29/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.9.29 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.9.29 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.9.29 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.9.29 These are the sha256 checksums of the uploaded files: feaf830ea206b8a0a20a0efab93a5c70ccf29f028bc28f7156b0484ec2f99609 ledgersmb-1.9.29.tar.gz b49c86e9a6d37f528c4a884357bd9c4954fbdd6b7c27b41ea34c34c348d67d66 ledgersmb-1.9.29.tar.gz.asc

1 0

LedgerSMB 1.11.10 released
by Erik Huelsmann 15 Feb '24

15 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.11.10 * Fix upgrades from older Pg versions with the 'cash_impact' view (#7987) * Fix missing locale parameter creating GL Search report (#7997) * Fix setup.pl CSRF regressions (#8007, #8000) * Fix date filters on Cash > Receipt/Payment (#8015) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.10/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.10 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.10 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.10 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.10 These are the sha256 checksums of the uploaded files: 5c08194e794a81c81cae4f747860a09457e14331dcd1e48dc8bab991a589ab4d ledgersmb-1.11.10.tar.gz 47578b10d626b81f0dbbdf9c2cc34d2ed839586959a5c33fd8062a05e93e24cf ledgersmb-1.11.10.tar.gz.asc

1 0

LedgerSMB 1.10.32 released
by Erik Huelsmann 15 Feb '24

15 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.10.32 * Fix upgrades from older Pg versions with the 'cash_impact' view (#7987) * Fix missing locale parameter creating GL Search report (#7997) * Fix setup.pl CSRF regressions (#8007, #8000) * Fix date filters on Cash > Receipt/Payment (#8015) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.32/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.32 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.32 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.32 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.32 These are the sha256 checksums of the uploaded files: 3695a892e6c9c4257106a03ac287fdf9af94d8d55b6036bf7acf1aa340a1cd18 ledgersmb-1.10.32.tar.gz 45cee80848ff757e885208940eb996bbaa91aa7ab6d05cd5e8cef6491d19a733 ledgersmb-1.10.32.tar.gz.asc

1 0

LedgerSMB 1.11.9 released
by Erik Huelsmann 02 Feb '24

02 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for CVE-2024-23831, a CSRF attack on setup.pl. Changelog for 1.11.9 * Add missing batch and entity sequences to the Defaults screen (#7965) * Stop warning during startup without configuration file (#7928) * CVE-2024-23831: CSRF attack on 'setup.pl' For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.11.9/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.11.9 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.11.9 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.11.9 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.11.9 These are the sha256 checksums of the uploaded files: 5c4ae06702dadd0de3f4e26727fe10ed2086cb932029714a0fdae49553025cab ledgersmb-1.11.9.tar.gz 182f21f0a2f720f2d17e812619b4109f929e3a1d5d88e4b2e459a053472c6237 ledgersmb-1.11.9.tar.gz.asc

1 0

LedgerSMB 1.10.31 released
by Erik Huelsmann 02 Feb '24

02 Feb '24

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the fix for security vulnerability CVE-2024-23831 which allows an attacker to create a user by tricking a setup.pl admin into clicking on a specifically crafted link. See more about this CVE on https://ledgersmb.org/cve-2024-23831-setup-csrf. Changelog for 1.10.31 * Fix GL transaction entry regressed from 1.10.29 (#7984) Changelog for 1.10.30 * Add missing batch and entity sequences to the Defaults screen (#7965) * Stop warning during startup without configuration file (#7928) * CVE-2024-23831: CSRF attack on 'setup.pl' For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.10.31/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.10.31 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.10.31 Docker images have been published for ARMv7 (32-bit), ARM64 (also known as ARMv8, e.g. RPi 3+) and AMD64. These can be pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.10.31 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.10.31 These are the sha256 checksums of the uploaded files: 15920bbe05a6e37ee9f4d7fe408adb587a20ae0e8c052f20df1e2909b4c7bc51 ledgersmb-1.10.31.tar.gz e03aeecd9087bbc25673bd13ec78962509f3b265886bb0a44949bde311cb06bc ledgersmb-1.10.31.tar.gz.asc

1 0

[SECURITY] Security advisory for CVE-2024-23831 (CSRF attack on setup.pl)
by Erik Huelsmann 02 Feb '24

02 Feb '24

On January 18 2024, the LedgerSMB project was advised of a security vulnerability in the code. Please see below our security advisory. Privilege escalation through CSRF attack on 'setup.pl' Summary: ======== When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used to create a new user account with full application (/login.pl) privileges, leading to privilege escalation. Known vulnerable: ================= All of: - 1.3.0 up to 1.3.47 (including) - 1.4.0 up to 1.4.42 (including) - 1.5.0 up to 1.5.30 (including) - 1.6.0 up to 1.6.33 (including) - 1.7.0 up to 1.7.32 (including) - 1.8.0 up to 1.8.31 (including) - 1.9.0 up to 1.9.30 (including) - 1.10.0 up to 1.10.29 (including) - 1.11.0 up to 1.11.8 (including) Known fixed: ============ - 1.10.30 - 1.11.9 Details: ======== CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim’s behalf [^1]. To successfully perform the attack, an attacker needs to know the name of the database for which they want to create a user. That is: in case LedgerSMB is used to maintain multiple company administrations, multiple attacks need to be performed to gain access to all of them. A single attack will gain access to a single company only, however, if companies share users, the attacker can use those to gain access to the other companies with the rights of the affected user accounts. In this specific attack, the victim must be an administrator of /setup.pl with an active session. It should be noted that the resulting user does *not* have full access to /setup.pl, but *does* have full access to /login.pl for a single company. This means that the resulting user can therefore *not* be used to create database backups, however the attack itself can be used by the attacker to perform any action supported by setup.pl. [^1]: https://owasp.org/www-community/attacks/csrf Severity: ========= CVSSv3.1 Base Score: 7.5 (HIGH) CVSSv3.1 Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSSv3.1 Base Score & Vector (with temporal score): 6.7 (MEDIUM) CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/… Recommendations: ================ We recommend all users to upgrade to known-fixed versions. Versions prior to 1.10 are end-of-life and will not receive security fixes from the LedgerSMB project. Users who cannot upgrade their 1.10 and 1.11 versions, may apply the included patches or are advised to contact a vendor for custom support. As a workaround, installations may choose not to expose and use /setup.pl, instead using the command line application "ledgersmb-admin" to perform administrative tasks. Password resets can be performed with regular /login.pl functionality or through PostgreSQL's "psql" command line tool. References: =========== CVE-2024-23831 (LedgerSMB) https://ledgersmb.org/cve-2024-23831-setup-csrf https://twelvesec.com/2024/02/02/cve-2024-23831 Reported by: ============ Georgios Roumeliotis (TwelveSec [twelvesec.com]) -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0