CordysCRM vulnerabilities

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite follow_time and follower on any known customer, clue or opportunity.

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details.

1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.

CordysCRM prior to 1.7.4 contains a vulnerability in the /attachment/preview/{id} and /pic/preview/{id} routes, which are configured as anonymous and call AttachmentService.getResource without ownership, organization, or permission checks. An unauthenticated attacker who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations.

CordysCRM prior to 1.7.4 contains a vulnerability in the GET /pool/lead/get/{id} and GET /pool/account/get/{id} routes, which use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values.

CordysCRM version 1.7.3 contains an SSRF vulnerability in ApprovalResourceService.sendWebHook, which reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it to HttpClientUtils without the SSRF validation. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add, and the server will request it when POST /approval-action/approve executes, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services.

CordysCRM versions 1.7.0 through 1.7.4 contain a SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING_UPDATE can place an arbitrary database function in SortRequest.name because Spring request validation is missing and the blacklist is incomplete. Functions such as extractvalue and updatexml can expose database values through an error oracle.

CordysCRM prior to version 1.7.2 allows unauthenticated access to the GET /mcp/form/config/{formKey} endpoint due to ShiroFilter marking /mcp/** as anonymous and missing permission annotations. An unauthenticated caller can obtain field names, types, validation rules, and binding sources for CRM modules, enabling reconstruction of the application data model.

CordysCRM prior to version 1.7.0 has a time-based blind SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING:UPDATE can place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation.

SSRF vulnerability in 1Panel-dev CordysCRM up to version 1.4.1 in the getSqlBotSrc function of IntegrationConfigService.java. A remote attacker can manipulate the appSecret argument, leading to HTTP requests to arbitrary internal resources.

A server-side request forgery (SSRF) vulnerability was found in the Third Party Endpoint component of CordysCRM up to version 1.4.1. The issue occurs in the TokenService.java file, where manipulation of the mkAddress argument allows remote attack execution. The project closed the report, stating it is not the official way to report a security vulnerability.

A cross-site scripting vulnerability was found in CordysCRM up to version 1.4.1 in the Save function of ModuleFormService.java. Manipulation of the Description argument allows remote XSS attacks. The exploit has been publicly disclosed.

A cross-site scripting vulnerability was found in CordysCRM up to version 1.6.2 in the file RequestParamTrimConfig.java. Remote attack is possible. Patch available in version 1.7.0.