CVE-2024-37821: Dolibarr ERP/CRM RCE Vulnerability

CVE-2024-37821 Overview

CVE-2024-37821 is an arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP/CRM through version 19.0.1. Authenticated attackers can upload a crafted .SQL file to execute arbitrary code on the host application. The flaw is classified as [CWE-94] Improper Control of Generation of Code (Code Injection). Because Dolibarr is widely deployed as a self-hosted business management platform, successful exploitation gives adversaries a foothold into finance, HR, and customer relationship data.

Critical Impact
Authenticated attackers can achieve arbitrary code execution on the Dolibarr host by abusing the Upload Template feature, compromising the confidentiality, integrity, and availability of the ERP/CRM instance.

Affected Products

Dolibarr ERP/CRM versions up to and including 19.0.1
Self-hosted Dolibarr instances exposing the module and template management interface
Deployments where low-privileged users have access to the Upload Template function

Discovery Timeline

2024-06-18 - CVE-2024-37821 published to the National Vulnerability Database
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2024-37821

Vulnerability Analysis

The vulnerability resides in the Upload Template feature of Dolibarr ERP/CRM. The application accepts template files without adequately validating file type, content, or execution context. An authenticated attacker crafts a malicious .SQL file and submits it through the upload interface. When the file is processed, its contents are interpreted in a way that leads to arbitrary code execution on the server hosting the application.

Because the attack path requires only low privileges and no user interaction, any account that can reach the template upload feature can weaponize the flaw. The result is full compromise of the ERP/CRM instance and the underlying operating system context in which Dolibarr runs. Additional technical details are documented in the public CVE writeup by alexbsec.

Root Cause

The root cause is insufficient validation of user-supplied template files. The Upload Template function does not enforce allow-list based checks on file extension, MIME type, or content. Malicious SQL payloads are stored and processed by the application, enabling code injection paths tracked under [CWE-94].

Attack Vector

Exploitation is remote and requires an authenticated session with access to the template upload workflow. The attacker submits a crafted .SQL file through the standard Dolibarr web interface. The application processes the file and executes attacker-controlled logic. No social engineering or user interaction is required to trigger the payload once the file is uploaded.

No verified public exploit code is currently linked in vendor advisories. See the external write-up for reproduction details.

Detection Methods for CVE-2024-37821

Indicators of Compromise

Unexpected .SQL files written to Dolibarr template or upload directories under the web root.
Web server or PHP-FPM processes spawning shells, sh, bash, python, perl, or outbound network connections shortly after a template upload event.
Access log entries showing POST requests to template upload endpoints from low-privileged accounts.
New or modified administrative accounts, cron jobs, or scheduled tasks on the Dolibarr host following an upload event.

Detection Strategies

Monitor file creation events under Dolibarr document, template, and upload directories for non-standard file extensions.
Alert on child process creation from the web server user (for example www-data, apache, nginx) that spawns interpreters or system utilities.
Correlate authenticated Dolibarr audit log events for template uploads with process and network telemetry from the host.
Baseline outbound network connections from the Dolibarr server and alert on new destinations following upload activity.

Monitoring Recommendations

Enable verbose application-level logging for template management functions and forward logs to a central SIEM.
Ingest web server access logs and endpoint process telemetry into a unified data lake to enable cross-source correlation.
Review privileged user activity on Dolibarr weekly, focusing on accounts able to reach the Upload Template feature.

How to Mitigate CVE-2024-37821

Immediate Actions Required

Upgrade Dolibarr ERP/CRM to a version later than 19.0.1 that addresses the arbitrary file upload issue.
Restrict access to the Upload Template function to a minimal set of trusted administrators.
Audit the Dolibarr document and template directories for unexpected .SQL files or recently modified content.
Rotate credentials for all Dolibarr accounts and review session tokens if compromise is suspected.

Patch Information

The vulnerability affects Dolibarr ERP/CRM up to and including version 19.0.1. Administrators should track the Dolibarr project releases and apply the latest stable version. Review the public CVE write-up for additional context on the affected code path.

Workarounds

Disable the template upload module for all non-administrative roles until patching is complete.
Place Dolibarr behind a web application firewall and block requests uploading files with SQL or other executable extensions to template endpoints.
Enforce filesystem controls that prevent the web server user from executing files inside upload directories, for example using noexec mount options or explicit deny rules.
Segment the Dolibarr host on the network and restrict outbound connectivity to reduce impact of successful exploitation.

bash

# Example: block execution from Dolibarr upload directory (Apache)
<Directory "/var/www/dolibarr/documents">
    php_admin_flag engine off
    Options -ExecCGI
    AllowOverride None
</Directory>