CVE-2024-29477: Dolibarr ERP/CRM RCE Vulnerability

CVE-2024-29477 Overview

CVE-2024-29477 affects Dolibarr ERP CRM versions up to and including 19.0.0. The vulnerability stems from missing input sanitization during the installation process. Attackers with adjacent network access can submit specifically crafted input to trigger arbitrary code execution on the host running Dolibarr.

The flaw is categorized under [CWE-94] (Improper Control of Generation of Code). Successful exploitation grants full compromise of confidentiality, integrity, and availability on the affected system. No authentication is required, and no user interaction is needed to reach the vulnerable installer endpoint.

Critical Impact
Unauthenticated adjacent-network attackers can execute arbitrary code on Dolibarr ERP CRM instances up to version 19.0.0, leading to complete system takeover.

Affected Products

Dolibarr ERP CRM versions up to and including 19.0.0
Deployments exposing the installation directory to internal networks
Self-hosted Dolibarr instances that retain installer scripts post-deployment

Discovery Timeline

2024-04-03 - CVE-2024-29477 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2024-29477

Vulnerability Analysis

Dolibarr ERP CRM ships with a web-based installation workflow used to configure the database connection, administrator account, and application parameters. The installer accepts user-supplied values and writes them into PHP configuration artifacts. Because input is not sanitized before being incorporated into executable context, an attacker can inject PHP code that runs when the resulting configuration file is loaded.

The vulnerability requires adjacent network access, meaning the attacker must be on the same logical network segment as the target. Once reached, exploitation does not require credentials or user interaction. This makes the flaw particularly relevant to enterprise deployments where Dolibarr is hosted on internal networks alongside untrusted endpoints.

Root Cause

The root cause is improper control of generation of code [CWE-94] during installation. The installer takes attacker-controllable strings, such as configuration values submitted through installer forms, and places them into files that are subsequently interpreted by the PHP runtime. Without sanitization or escaping, these values can break out of intended string contexts and introduce arbitrary PHP statements.

Attack Vector

An attacker on an adjacent network locates a Dolibarr instance with an accessible installer, submits crafted input through the installation form fields, and forces the application to write malicious code into a configuration file. When Dolibarr loads that file, the injected payload executes with the privileges of the web server process. See the GitHub CVE-2024-29477 Details writeup for a technical walkthrough.

Detection Methods for CVE-2024-29477

Indicators of Compromise

Unexpected modifications to Dolibarr configuration files such as conf/conf.php outside of maintenance windows
Web server access logs showing POST requests to install/ endpoints from internal hosts
New PHP files or web shells appearing under the Dolibarr document root
Outbound network connections from the Dolibarr web server process to unfamiliar hosts

Detection Strategies

Monitor HTTP requests to Dolibarr install/ paths and alert when they occur on production systems where installation should already be complete
Compare current conf.php contents against known-good baselines to identify injected PHP statements
Inspect running Dolibarr processes for child processes spawning shells, curl, wget, or other post-exploitation tooling

Monitoring Recommendations

Enable file integrity monitoring on the Dolibarr application directory, prioritizing conf/ and install/
Aggregate web server logs into a SIEM and build detections for anomalous POST payloads to installer endpoints
Track process ancestry for the PHP-FPM or web server user to catch code execution originating from Dolibarr

How to Mitigate CVE-2024-29477

Immediate Actions Required

Upgrade Dolibarr ERP CRM to a version later than 19.0.0 that addresses CVE-2024-29477
Remove or restrict access to the install/ directory on production deployments
Restrict network access to Dolibarr so that only trusted management hosts can reach the application
Audit configuration files and application directories for signs of prior exploitation

Patch Information

Users should update to a Dolibarr release later than 19.0.0 as soon as an upgrade path is validated. Refer to the GitHub CVE-2024-29477 Details writeup and official Dolibarr release notes for fixed versions and upgrade guidance.

Workarounds

Delete or rename the install/ directory after initial deployment so the installer cannot be reinvoked
Enforce web server access control lists on installer paths, permitting only administrative source addresses
Place Dolibarr behind a reverse proxy that blocks external and untrusted internal access to installation URLs
Run the web server process with the least privileges required, limiting the blast radius of code execution

bash

# Configuration example: block access to Dolibarr installer paths in nginx
location ^~ /install/ {
    deny all;
    return 403;
}