CVE-2023-22952
Multiple SugarCRM Products Remote Code Execution Vulnerability
Description
CVE-2023-22952 is a high-severity remote code execution vulnerability in SugarCRM that allows an authenticated attacker to inject and execute arbitrary PHP code through the EmailTemplates functionality due to missing input validation. Affecting SugarCRM versions prior to the 12.0 Hotfix 91155, this vulnerability enables attackers with low-privilege network access to achieve complete server compromise. With a CVSS v3.1 score of 8.8 and an EPSS score of 93.1% (99.78th percentile), CVE-2023-22952 has been actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 23, 2023, and its ransomware exploitation status remains under assessment.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| sugarcrm | sugarcrm | >= 11.0.0, < 11.0.5; >= 12.0.0, < 12.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html(Exploit, Third Party Advisory, VDB Entry)
- https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22952(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
The root cause of CVE-2023-22952 involves improper input validation (CWE-20) in the EmailTemplates functionality of SugarCRM. The application fails to properly sanitize and validate user-supplied input when processing email template data, allowing attackers to inject malicious content that is interpreted as executable code.
Learn more: CWE-20 — Improper Input Validation
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2023-22952 also falls under CWE-94, which describes situations where software constructs code segments using externally-influenced input without properly neutralizing special elements. In this case, the SugarCRM EmailTemplates feature processes crafted requests in a way that allows custom PHP code to be injected and executed on the server, granting the attacker the ability to run arbitrary commands with the privileges of the web application.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2023-22952 carries a CVSS v3.1 score of 8.8 (High severity), indicating substantial risk for organizations running unpatched SugarCRM instances. Attack Vector (Network): The vulnerability can be exploited remotely over the network, meaning any SugarCRM instance accessible via HTTP is a potential target. Attack Complexity (Low): No special conditions or timing are needed for exploitation. Privileges Required (Low): An attacker needs only a low-privilege authenticated session to exploit the vulnerability, which is achievable through credential compromise, default credentials, or a separate authentication bypass. User Interaction (None): Exploitation is fully automated once authenticated access is obtained. Scope (Unchanged): The impact remains within the SugarCRM application boundary. Confidentiality Impact (High), Integrity Impact (High), and Availability Impact (High) reflect that successful exploitation yields arbitrary PHP code execution, granting the attacker complete control over the SugarCRM server, including access to all CRM data such as customer records, sales pipelines, communications, and associated business intelligence. The EPSS score of 93.1% (99.78th percentile) confirms extremely high exploitation probability. CISA's ransomware association is listed as Unknown, indicating that while the exploitation is confirmed, the specific use in ransomware campaigns has not yet been definitively established.
Exploit Maturity
Public exploit code is available for CVE-2023-22952 via Packet Storm Security, demonstrating remote code execution and web shell upload capabilities against SugarCRM 12.x installations. CISA added CVE-2023-22952 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 23, 2023, confirming active exploitation in the wild. The ransomware exploitation status is Unknown per CISA's assessment, meaning exploitation has been confirmed but a direct link to ransomware campaigns has not been publicly established. The EPSS score of 93.1% (99.78th percentile) indicates a very high probability of continued exploitation, consistent with the availability of weaponized exploit code and the valuable business data typically stored in CRM platforms that makes SugarCRM installations attractive targets for data theft and extortion operations.
Remediation
- Apply SugarCRM Hotfix 91155 or upgrade to a patched version immediately as outlined in SugarCRM's security advisory SA-2023-001. This is required by CISA's KEV catalog directive, which mandates applying vendor mitigations or discontinuing use of the product by February 23, 2023.
- Audit all SugarCRM user accounts for unauthorized access or suspicious activity. Since the vulnerability requires low-privilege authentication, review login logs for anomalous access patterns, brute-force attempts, or logins from unusual geographic locations. Disable or reset credentials for any compromised accounts.
- Check for web shells and unauthorized files on the SugarCRM server, particularly in upload directories and writable locations. The public exploit demonstrates shell upload capability, so perform a thorough file system integrity check against known-good baselines.
- Restrict network access to SugarCRM by placing the application behind a web application firewall (WAF) with rules to detect and block code injection attempts in email template requests. Limit access to the administrative interface to trusted networks only.
- Implement robust input validation and output encoding across your SugarCRM customizations, and enable application-level logging to detect future exploitation attempts against the EmailTemplates functionality and other user-controllable input vectors.
Technical Details
CVE-2023-22952 exploits two related weaknesses: improper input validation (CWE-20) and code injection (CWE-94) in the EmailTemplates functionality of SugarCRM. The application provides a feature for creating and managing email templates, which includes the ability to process template content with embedded dynamic elements. The vulnerability exists because the application does not properly validate or sanitize user input when processing crafted requests to the EmailTemplates endpoint. An attacker with a valid low-privilege SugarCRM session can submit a specially crafted request that injects custom PHP code into the template processing pipeline. Because the injected code is evaluated by the PHP interpreter on the server, this results in arbitrary code execution with the privileges of the web application user. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-based exploitation with low complexity and low privilege requirements, resulting in complete compromise of the confidentiality, integrity, and availability of the SugarCRM system. Affected versions include SugarCRM releases prior to the 12.0 Hotfix 91155. The practical impact is severe because CRM systems typically store extensive customer data, business communications, and sales information that is highly valuable to threat actors.
Frequently Asked Questions
Is CVE-2023-22952 being actively exploited?
Yes, CVE-2023-22952 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 23, 2023. Public exploit code demonstrating remote code execution and web shell upload is available. The EPSS score of 93.1% (99.78th percentile) confirms very high exploitation activity.
What products are affected by CVE-2023-22952?
CVE-2023-22952 affects SugarCRM installations prior to the 12.0 Hotfix 91155. The vulnerability is in the EmailTemplates functionality and impacts multiple SugarCRM product editions. Organizations running unpatched versions with the application accessible over the network are at risk.
How do I fix CVE-2023-22952?
Apply SugarCRM Hotfix 91155 or upgrade to a patched version as documented in SugarCRM's security advisory SA-2023-001. If immediate patching is not possible, restrict network access to the SugarCRM application and audit for signs of compromise including unauthorized web shells and suspicious user activity.
How severe is CVE-2023-22952?
CVE-2023-22952 has a CVSS v3.1 score of 8.8 (High severity). While it requires low-privilege authentication, exploitation leads to arbitrary PHP code execution and complete server compromise. CRM systems contain valuable customer and business data, making this vulnerability particularly impactful for organizations relying on SugarCRM for their business operations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.