CVE-2023-30253: Dolibarr ERP/CRM RCE Vulnerability

CVE-2023-30253 Overview

CVE-2023-30253 is a remote code execution vulnerability affecting Dolibarr ERP/CRM versions prior to 17.0.1. The vulnerability allows authenticated users to execute arbitrary code on the server by exploiting a case-sensitivity bypass in PHP tag filtering. By using uppercase PHP tags (<?PHP instead of <?php), attackers can inject malicious PHP code that bypasses input validation mechanisms.

Critical Impact

Authenticated attackers can achieve full remote code execution on vulnerable Dolibarr installations, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Dolibarr ERP/CRM versions before 17.0.1
• All installations with default PHP tag filtering mechanisms
• Self-hosted and cloud-deployed Dolibarr instances

Discovery Timeline

• 2023-05-29 - CVE CVE-2023-30253 published to NVD
• 2025-01-14 - Last updated in NVD database

Technical Details for CVE-2023-30253

Vulnerability Analysis

This remote code execution vulnerability exists due to improper input validation in Dolibarr's content filtering mechanism. The application implements a filter designed to prevent PHP code injection by blocking the standard <?php opening tag. However, the filter performs case-sensitive matching, which fails to account for PHP's case-insensitive handling of opening tags. Since PHP interprets <?PHP, <?Php, and other case variations identically to <?php, attackers can trivially bypass the security filter while still achieving code execution.

The vulnerability is classified under CWE-78 (OS Command Injection), indicating that successful exploitation allows attackers to execute arbitrary operating system commands through the injected PHP code. This represents a critical security boundary violation where user-supplied input can influence command execution on the underlying server.

Root Cause

The root cause is a flawed input validation approach that relies on exact string matching rather than case-insensitive pattern matching. The filter checks for the lowercase <?php string but fails to normalize input or use case-insensitive comparison. This oversight allows uppercase variants like <?PHP to pass through the filter undetected. PHP's parser treats all case variations of the opening tag equivalently, meaning the injected code executes normally despite bypassing the intended security control.

Attack Vector

The attack requires network access and valid authentication credentials to the Dolibarr application. An authenticated user can inject PHP code into data fields that are subsequently processed or rendered by the application. By substituting the standard <?php tag with <?PHP or similar case variations, the attacker's code bypasses the filter and executes when the data is processed.

The exploitation technique is straightforward:

1. Authenticate to the Dolibarr application with valid credentials
2. Identify input fields that accept user data and are later processed by PHP
3. Inject malicious PHP code using uppercase opening tags (e.g., <?PHP system($_GET['cmd']); ?>)
4. Trigger the execution of the injected code through normal application functionality

The vulnerability requires no user interaction beyond the initial authentication, and the low attack complexity combined with the potential for complete system compromise makes this a particularly dangerous flaw.

Detection Methods for CVE-2023-30253

Indicators of Compromise

• Presence of PHP code with uppercase tags (<?PHP, <?Php, etc.) in database fields, uploaded files, or application logs
• Unexpected outbound network connections from the Dolibarr web server
• New or modified files in web-accessible directories with suspicious PHP content
• Unusual process execution from the web server user account (e.g., www-data, apache)

Detection Strategies

• Implement web application firewall (WAF) rules to detect case-insensitive PHP tag patterns in request parameters
• Monitor application logs for requests containing encoded or obfuscated PHP tags
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process spawning from web server processes
• Conduct regular database audits to identify stored PHP code with non-standard tag casing

Monitoring Recommendations

• Enable verbose logging for Dolibarr application activities and review for anomalous input patterns
• Configure SIEM alerts for command execution patterns originating from web server processes
• Monitor file integrity on Dolibarr installation directories for unauthorized modifications
• Track authentication events and correlate with subsequent suspicious activity patterns

How to Mitigate CVE-2023-30253

Immediate Actions Required

• Upgrade Dolibarr to version 17.0.1 or later immediately
• Audit existing database content for injected PHP code using case-insensitive searches
• Review access logs to identify potential exploitation attempts
• Restrict network access to Dolibarr instances while patching is in progress

Patch Information

The vulnerability has been addressed in Dolibarr version 17.0.1. Organizations running affected versions should upgrade immediately. Detailed information about the vulnerability and remediation steps can be found in the Swascan Security Advisory for Dolibarr 17.0.0. The official Dolibarr GitHub repository contains the patched source code and release notes.

Workarounds

• Implement strict input validation at the web server level using case-insensitive patterns to block all PHP tag variations
• Deploy a web application firewall with rules specifically targeting PHP code injection attempts
• Restrict file upload functionality and disable any features that allow user-controlled content to be processed as PHP
• Limit user privileges to reduce the potential impact of compromised accounts