How secure is CiviCRM?

Question

How does CiviCRM keep our data secure? Is the program web-based? Or is it desktop based? I am interested in downloading and trying CiviCRM for our organization but can't find an information on security features.

Thank you.

Answer 1

CiviCRM does not do anything special to either keep your data secure or insecure. It stores data in a MySQL database like lots of other applications.

The security is more in the way you configure your database server and the way CiviCRM (which is a web application and not a desktop application) can be accessed from outside.

A little more information in the configuration we tend to advise as the most secure (but also as usual most cumbersome and expensive) can be found in this CiviCon session by my community mate Björn Endres: https://www.youtube.com/watch?v=JKNR0bDjB9k

Answer 2

CiviCRM is a web-based tool and has no desktop component. It is thus as secure the server which hosts it, be that a local one or a remote one.

There are occasionally security flaws found in the software, just like any other package. The CiviCRM team then fixes those and releases new versions.

You can find more information about CiviCRM security here:

https://civicrm.org/security

Answer 3

Speaking in a personal capacity.

I have previously found multiple SQL injection issues in Civicrm which allowed any authenticated user to download the whole database of civicrm irrespective of the permissions. These were fixed and are publicly documented.

I re-examined the current 4.x recently and found no SQL injection issues. But the code has no systematic protection against such issues, unlike WordPress which provides its own database interface which is robust. So we are one developer error from reintroducing the same.

The code base appears to have multiple stored XSS issues. These would allow a malicious user to insert JavaScript which would allow a user allowed to manage events say to escalate their permissions to full administrator. Again there is no effective systematic defence to XSS built-in.

The product will try to create a separate database when installed into a WordPress site, which will typically keep the data safe from a SQL injection issue in the WordPress site.

XSS issues in WordPress plugins are common, and the escalation from XSS to controlling PHP on WordPress (when the Civicrm data could be compromised) is well documented. Attack tools like BeEF offer it as a point and click feature. This is not a Civicrm issue but a result of running such a service within a WordPress site.

I suspect similar comments apply to Drupal but I haven’t tested it there.

Not being familiar with the alternatives, and with a lot more to learn about Civicrm, I would advise organisations deploying Civicrm to consult a web applications security expert.

The issues described can be mitigated to an extent (CSP, mod-security etc), but certainly in Europe you face potentially large fines for leaking personal data, and keeping that data in public web applications with a history of issues could present problems. Especially if your organisation might reasonably be a target of focused attacks or is at all controversial.