Skip to content

Security

Security update for Lime CRM Desktop Client

Bulletin ID LCSEC20-01 Date published 2020-12-21 Priority 2 Severity Critical

Priority and severity ratings are determined as described here.

Summary

This security update resolved a vulnerability in Lime CRM Desktop Client. The vulnerability enables local Windows users to execute programs with elevated privileges.

Affected versions

Product Version Platform
Lime CRM Desktop Client initial – 10.18.579 Windows

Solution

Upgrade to newest version of Lime CRM Desktop Client.

Product Type Updated version Availability
Lime CRM Desktop Client Product release 10.18.962 - latest Download

Vulnerability information

Detailed summary

An attacker could launch Lime CRM Desktop Client with elevated privileges and via programmatic extensions or documents launch any Windows process with elevated privileges.

Mitigating factors

The attacker must be an authenticated user for the system and have a high technical knowledge about it.

  • Last modified: 3 years ago
  • by Jonatan Folger Asu

Security implications of Apache Log4j vulnerabilities

Bulletin ID LCSEC21-01 Date published 2021-12-12 Priority 1 Severity Important

Priority and severity ratings are determined as described here.

Activity log

Date Update
2021-12-21 10.39 New version of Lime BI is now available.
2021-12-21 08.30 Simplified Lime BI mitigation instruction.
2021-12-20 08.48 Added info regarding CVE-2021-45105.
2021-12-15 12.29 Added info regarding CVE-2021-45046.
2021-12-13 16.25 A patch has been published and is available to mitigate the vulnerability.
2021-12-13 15.48 A patch has been created and is being validated.
2021-12-13 11.42 Updated info regarding Elasticsearch.
2021-12-12 20.24 Page created.

Summary

A high severity vulnerability (CVE-2021-44228) in the widely used Java logging framework Apache Log4j has been disclosed. Log4j is not directly used in Lime CRM, but it is used via third party components in the following system services:

  • Full-text search

The Elasticsearch search engine may be susceptible to information leakage caused by the vulnerability. * Lime BI add-on

Metabase powers the BI engine in Lime BI and is affected by the vulnerability when installed on-premises.

A related vulnerability (CVE-2021-45046) was disclosed 2021-12-14. Lime BI is not affected by this vulnerability. Applying the patch for Lime CRM (below) will also remediate any possible vulnerability to CVE-2021-45046.

Yet another vulnerability (CVE-2021-45105) was disclosed 2021-12-16. Applying the existing Lime CRM patch (below) will remediate the vulnerability (denial of service). No mitigation exists for Lime BI, await official update.

Affected versions

Product Version Platform
Lime CRM ⇐ 2021.1.523 On-premises
Lime BI < 3.32.0 On-premises

Remediation

Updated installers for Lime CRM and Lime BI will be released when ready. Until then perform mitigation actions as detailed below.

Vulnerability information

Detailed summary

General details about the vulnerability can be found online, for example at:

Details regarding how Elasticsearch is affected can be found here.

Mitigation

There are patches available for both Lime CRM and Lime BI. Depending on which service you are using both need to be applied.

Lime CRM

Download and execute the Python script found here. The script supports all versions of Lime CRM and needs to be run with admin privileges. It will automatically remove the vulnerability from the log4j library. Note that the Lime CRM Search Engine service will be restarted.

Usage:

  1. Unzip the downloaded file and copy the contained patch-log4j-cve-2021-44228.py script to a temporary folder on the Lime CRM server.
  2. Launch an elevated command prompt (cmd.exe).
  3. Run the following command to activate the correct Python environment: 

"C:\Program Files (x86)\Lundalogik\procmd.bat"
4. Apply the patch with the following command (make sure to replace the path to the script): 
python "c:\path\to\patch-log4j-cve-2021-44228.py"

If the installation is not located at C:\Program Files (x86)\Lundalogik\ the following command can be used to specify the correct location:

python "c:\path\to\patch-log4j-cve-2021-44228.py" --installdir "x:path\to\LIME Pro Server"

If the patch is successful the script will output The patch has been applied in green text.

Lime BI

An update of Lime BI is available which can be installed by updating to v3.32.0 or later. This update removes the vulnerability and enables the mitigation below. Note that the installer needs to be re-run as well in order to fully upgrade to the latest version.

For on-premises installations of Lime BI that cannot be updated to the latest version, the vulnerability can be mitigated by modifying Java runtime options. Execute the following command:

"C:\Program Files (x86)\Lundalogik\Python3\Lib\site-packages\nssm\bin\win64\nssm.exe" set lime-crm-bi AppParameters "-Dlog4j2.formatMsgNoLookups=true -jar ""c:\Lime BI\metabase.jar"""

Then restart the Lime BI service:

net stop lime-crm-bi
net start lime-crm-bi
  • Last modified: 12 months ago
  • by Jens Gustafsson

Security update for Lime CRM Server

Bulletin ID LCSEC18-01 Date published 2018-07-05 Priority 2 Severity Critical

Priority and severity ratings are determined as described here.

Summary

This security update resolves a vulnerability in Lime CRM Server. The vulnerability could allow remote code execution in Lime CRM Server if an attacker alters the system configuration in a malicious way. However, an attacker would need access to a user account with administrator privileges in order to succeed with exploiting the vulnerability.

Affected versions

Product Version Platform
Lime CRM Server 12.25 - 12.41.1.5 All platforms

Solution

Lime categorizes this update with the following priority rating and recommends customers to either install the provided hotfix or update their installation to the newest version:

Product Type Updated version Priority rating Availability
Lime CRM Server Hotfix for any affected version - 2 Download
Lime CRM Server Product release 12.41.2.5 2 Download

Vulnerability information

Detailed summary

A remote code execution vulnerability exists in Lime CRM Server software when the software fails to properly validate configuration data input by users with administrator privileges. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the user running the Lime CRM Web Server service. If that user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Mitigating factors

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in this situation:

  • Running the Lime CRM Web Server service under an account configured to have fewer user rights on the system could be less impacted than running as a user operating with full administrative rights.

Workarounds

Workaround refers to a setting or configuration change that would help block known attack vectors before you apply the update.

  • Update firewall/proxy rules to deny HTTP requests using the PUT verb for the following endpoints: 
    https://lime.example.com/<appname>/api/v1/activitytype/
https://lime.example.com/<appname>/widgets/widget-salespipe/config
https://lime.example.com/<appname>/webclient/add/config

The impact of this workaround is that it will not be possible to update Lime CRM Web Client configuration until rules are disabled or removed.