1 line
6.9 KiB
JSON
1 line
6.9 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-fx6j-9pp6-ph36","published":"2024-07-30T14:52:51Z","modified":"2026-09-10T03:50:16.645355558Z","aliases":["CVE-2024-41109"],"summary":"Pimcore vulnerable to disclosure of system and database information behind /admin firewall","details":"### Summary\n\nNavigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.\n\n> The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.\n\n### Details\n\n`/admin/index/statistics` returns the following JSON-response:\n```\n{\n {\n \"instanceId\": \"...\",\n \"pimcore_major_version\": 11,\n \"pimcore_version\": \"v11.3.1\",\n \"pimcore_hash\": \"3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008\",\n \"pimcore_platform_version\": \"v2024.2\",\n \"php_version\": \"8.3.8\",\n \"mysql_version\": \"10.11.8-MariaDB-ubu2204\",\n \"bundles\": [\n // all installed bundles\n ],\n \"tables\": [\n // all tables and their row count, e.g:\n {\n \"name\": \"users\",\n \"rows\": 2\n },\n ]\n}\n```\n\nInformation about the Pimcore Version can also be seen here:\n\nIn a current Version:\n](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)\n](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)\n\nIn Pimcore Version 10.6.9:\n](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)\n](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)\n\n### PoC\n\n- [[Demo App](https://demo.pimcore.fun/admin)](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo\n- Watching Network-Tab in Developer-Tools and looking for `/admin/index/statistics`\n\n### Impact\n\nOnly for logged in Pimcore users possible.\n\n### Workaround and Patch\n\nWe patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.\nThis resolves navigating to `/admin/index/statistics`.\n\n```patch\ndiff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php\n--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (revision dd81ef4c666b18c254333867a60f6ed455025076)\n+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (date 1721225746781)\n@@ -15,6 +15,7 @@\n\nnamespace Pimcore\\Bundle\\AdminBundle\\Controller\\Admin;\n\n+use App\\Constant\\UserPermission;\nuse Doctrine\\DBAL\\Connection;\nuse Exception;\nuse Pimcore\\Analytics\\Google\\Config\\SiteConfigProvider;\n@@ -142,6 +143,12 @@\nthrow $this->createAccessDeniedHttpException();\n}\n\n+ $user = $this->tokenResolver->getUser();\n+\n+ if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n+ throw $this->createAccessDeniedException();\n+ }\n+\n// DB\ntry {\n$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES\n````\n\nFor the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:\n\n```php\n<?php\n\nnamespace App\\EventListener\\Admin;\n\nuse App\\Constant\\UserPermission;\nuse Pimcore\\Bundle\\AdminBundle\\Event\\AdminEvents;\nuse Pimcore\\Event\\Admin\\IndexActionSettingsEvent;\nuse Pimcore\\Security\\User\\TokenStorageUserResolver;\nuse Symfony\\Component\\EventDispatcher\\EventSubscriberInterface;\n\n/**\n* @deprecated and cannot be used in Pimcore 11\n*/\nclass PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface\n{\n public function __construct(private readonly TokenStorageUserResolver $tokenResolver)\n {\n }\n\n public static function getSubscribedEvents()\n {\n return [\n AdminEvents::INDEX_ACTION_SETTINGS => ['onIndexActionSettingsEvent'],\n ];\n }\n\n public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void\n {\n $user = $this->tokenResolver->getUser();\n if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n return;\n }\n\n $settings = $event->getSettings();\n $settings['instanceId'] = '';\n $settings['version'] = '';\n $settings['build'] = '';\n $event->setSettings($settings);\n }\n}\n```","affected":[{"package":{"name":"pimcore/admin-ui-classic-bundle","ecosystem":"Packagist","purl":"pkg:composer/pimcore/admin-ui-classic-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2"}]}],"versions":["1.4.0","v1.0.0","v1.0.0-BETA1","v1.0.0-RC1","v1.0.0-RC2","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.1.0","v1.1.0-RC1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.2","v1.2.0-RC1","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.0-RC1","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.5.0","v1.5.0-RC1","v1.5.0-RC2","v1.5.1"],"database_specific":{"last_known_affected_version_range":"<= 1.5.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-fx6j-9pp6-ph36/GHSA-fx6j-9pp6-ph36.json"}}],"references":[{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41109"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"},{"type":"PACKAGE","url":"https://github.com/pimcore/admin-ui-classic-bundle"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"}],"database_specific":{"cwe_ids":["CWE-200"],"github_reviewed":true,"github_reviewed_at":"2024-07-30T14:52:51Z","nvd_published_at":"2024-07-30T15:15:12Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]} |