CVE-2024-41109 (GCVE-0-2024-41109)
Vulnerability from cvelistv5
Published
2024-07-30 14:43
Modified
2024-08-02 04:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| pimcore | admin-ui-classic-bundle |
Version: < 1.5.2 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:pimcore:admin_classic_bundle:-:*:*:*:*:pimcore:*:*"
],
"defaultStatus": "unknown",
"product": "admin_classic_bundle",
"vendor": "pimcore",
"versions": [
{
"lessThan": "1.5.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41109",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-30T14:59:38.080151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-30T15:05:17.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.472Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"
},
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"
},
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"
},
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "admin-ui-classic-bundle",
"vendor": "pimcore",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pimcore\u0027s Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-30T14:43:14.407Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"
},
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"
},
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"
},
{
"name": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"
}
],
"source": {
"advisory": "GHSA-fx6j-9pp6-ph36",
"discovery": "UNKNOWN"
},
"title": "Pimcore vulnerable to disclosure of system and database information behind /admin firewall"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-41109",
"datePublished": "2024-07-30T14:43:14.407Z",
"dateReserved": "2024-07-15T15:53:28.321Z",
"dateUpdated": "2024-08-02T04:46:52.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-41109\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-07-30T15:15:12.890\",\"lastModified\":\"2024-11-21T09:32:15.027\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pimcore\u0027s Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.\"},{\"lang\":\"es\",\"value\":\" El paquete Admin Classic de Pimcore proporciona una interfaz de usuario backend para Pimcore. Navegar a `/admin/index/statistics` con un usuario de Pimcore conectado expone informaci\u00f3n sobre la instalaci\u00f3n de Pimcore, la versi\u00f3n de PHP, la versi\u00f3n de MYSQL, los paquetes instalados y todas las tablas de la base de datos y su recuento de filas en el sistema. Esta vulnerabilidad se solucion\u00f3 en 1.5.2, 1.4.6 y 1.3.10.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:52.472Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41109\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-30T14:59:38.080151Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:pimcore:admin_classic_bundle:-:*:*:*:*:pimcore:*:*\"], \"vendor\": \"pimcore\", \"product\": \"admin_classic_bundle\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.5.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-30T15:01:11.148Z\"}}], \"cna\": {\"title\": \"Pimcore vulnerable to disclosure of system and database information behind /admin firewall\", \"source\": {\"advisory\": \"GHSA-fx6j-9pp6-ph36\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"pimcore\", \"product\": \"admin-ui-classic-bundle\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.5.2\"}]}], \"references\": [{\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2\", \"name\": \"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Pimcore\u0027s Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-30T14:43:14.407Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-41109\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T04:46:52.472Z\", \"dateReserved\": \"2024-07-15T15:53:28.321Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-30T14:43:14.407Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
ghsa-fx6j-9pp6-ph36
Vulnerability from github
Published
2024-07-30 14:52
Modified
2024-07-30 15:44
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
VLAI Severity ?
Summary
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Details
Summary
Navigating to /admin/index/statistics with a logged in Pimcore user (not an XmlHttpRequest because of this check: IndexController:125) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.
The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.
Details
/admin/index/statistics returns the following JSON-response:
{
{
"instanceId": "...",
"pimcore_major_version": 11,
"pimcore_version": "v11.3.1",
"pimcore_hash": "3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008",
"pimcore_platform_version": "v2024.2",
"php_version": "8.3.8",
"mysql_version": "10.11.8-MariaDB-ubu2204",
"bundles": [
// all installed bundles
],
"tables": [
// all tables and their row count, e.g:
{
"name": "users",
"rows": 2
},
]
}
Information about the Pimcore Version can also be seen here:
In a current Version:
In Pimcore Version 10.6.9:
PoC
- [Demo App](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo
- Watching Network-Tab in Developer-Tools and looking for
/admin/index/statistics
Impact
Only for logged in Pimcore users possible.
Workaround and Patch
We patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.
This resolves navigating to /admin/index/statistics.
```patch diff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php --- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (revision dd81ef4c666b18c254333867a60f6ed455025076) +++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (date 1721225746781) @@ -15,6 +15,7 @@
namespace Pimcore\Bundle\AdminBundle\Controller\Admin;
+use App\Constant\UserPermission; use Doctrine\DBAL\Connection; use Exception; use Pimcore\Analytics\Google\Config\SiteConfigProvider; @@ -142,6 +143,12 @@ throw $this->createAccessDeniedHttpException(); }
- $user = $this->tokenResolver->getUser(); +
- if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
- throw $this->createAccessDeniedException();
- }
+
// DB
try {
$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as
rowsfrom information_schema.TABLES ````
For the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:
```php <?php
namespace App\EventListener\Admin;
use App\Constant\UserPermission; use Pimcore\Bundle\AdminBundle\Event\AdminEvents; use Pimcore\Event\Admin\IndexActionSettingsEvent; use Pimcore\Security\User\TokenStorageUserResolver; use Symfony\Component\EventDispatcher\EventSubscriberInterface;
/* * @deprecated and cannot be used in Pimcore 11 / class PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface { public function __construct(private readonly TokenStorageUserResolver $tokenResolver) { }
public static function getSubscribedEvents()
{
return [
AdminEvents::INDEX_ACTION_SETTINGS => ['onIndexActionSettingsEvent'],
];
}
public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void
{
$user = $this->tokenResolver->getUser();
if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
return;
}
$settings = $event->getSettings();
$settings['instanceId'] = '';
$settings['version'] = '';
$settings['build'] = '';
$event->setSettings($settings);
}
} ```
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.5.1"
},
"package": {
"ecosystem": "Packagist",
"name": "pimcore/admin-ui-classic-bundle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41109"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-30T14:52:51Z",
"nvd_published_at": "2024-07-30T15:15:12Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nNavigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.\n\n\u003e The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.\n\n### Details\n\n`/admin/index/statistics` returns the following JSON-response:\n```\n{\n {\n \"instanceId\": \"...\",\n \"pimcore_major_version\": 11,\n \"pimcore_version\": \"v11.3.1\",\n \"pimcore_hash\": \"3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008\",\n \"pimcore_platform_version\": \"v2024.2\",\n \"php_version\": \"8.3.8\",\n \"mysql_version\": \"10.11.8-MariaDB-ubu2204\",\n \"bundles\": [\n // all installed bundles\n ],\n \"tables\": [\n // all tables and their row count, e.g:\n {\n \"name\": \"users\",\n \"rows\": 2\n },\n ]\n}\n```\n\nInformation about the Pimcore Version can also be seen here:\n\nIn a current Version:\n](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)\n](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)\n\nIn Pimcore Version 10.6.9:\n](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)\n](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)\n\n### PoC\n\n- [[Demo App](https://demo.pimcore.fun/admin)](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo\n- Watching Network-Tab in Developer-Tools and looking for `/admin/index/statistics`\n\n### Impact\n\nOnly for logged in Pimcore users possible.\n\n### Workaround and Patch\n\nWe patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.\nThis resolves navigating to `/admin/index/statistics`.\n\n```patch\ndiff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php\n--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (revision dd81ef4c666b18c254333867a60f6ed455025076)\n+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (date 1721225746781)\n@@ -15,6 +15,7 @@\n\nnamespace Pimcore\\Bundle\\AdminBundle\\Controller\\Admin;\n\n+use App\\Constant\\UserPermission;\nuse Doctrine\\DBAL\\Connection;\nuse Exception;\nuse Pimcore\\Analytics\\Google\\Config\\SiteConfigProvider;\n@@ -142,6 +143,12 @@\nthrow $this-\u003ecreateAccessDeniedHttpException();\n}\n\n+ $user = $this-\u003etokenResolver-\u003egetUser();\n+\n+ if (!$user-\u003eisAdmin() \u0026\u0026 !$user-\u003eisAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n+ throw $this-\u003ecreateAccessDeniedException();\n+ }\n+\n// DB\ntry {\n$tables = $db-\u003efetchAllAssociative(\u0027SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES\n````\n\nFor the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions \u003c Pimcore 11:\n\n```php\n\u003c?php\n\nnamespace App\\EventListener\\Admin;\n\nuse App\\Constant\\UserPermission;\nuse Pimcore\\Bundle\\AdminBundle\\Event\\AdminEvents;\nuse Pimcore\\Event\\Admin\\IndexActionSettingsEvent;\nuse Pimcore\\Security\\User\\TokenStorageUserResolver;\nuse Symfony\\Component\\EventDispatcher\\EventSubscriberInterface;\n\n/**\n* @deprecated and cannot be used in Pimcore 11\n*/\nclass PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface\n{\n public function __construct(private readonly TokenStorageUserResolver $tokenResolver)\n {\n }\n\n public static function getSubscribedEvents()\n {\n return [\n AdminEvents::INDEX_ACTION_SETTINGS =\u003e [\u0027onIndexActionSettingsEvent\u0027],\n ];\n }\n\n public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void\n {\n $user = $this-\u003etokenResolver-\u003egetUser();\n if ($user-\u003eisAdmin() || $user-\u003eisAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n return;\n }\n\n $settings = $event-\u003egetSettings();\n $settings[\u0027instanceId\u0027] = \u0027\u0027;\n $settings[\u0027version\u0027] = \u0027\u0027;\n $settings[\u0027build\u0027] = \u0027\u0027;\n $event-\u003esetSettings($settings);\n }\n}\n```",
"id": "GHSA-fx6j-9pp6-ph36",
"modified": "2024-07-30T15:44:10Z",
"published": "2024-07-30T14:52:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41109"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/admin-ui-classic-bundle"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Pimcore vulnerable to disclosure of system and database information behind /admin firewall"
}
fkie_cve-2024-41109
Vulnerability from fkie_nvd
Published
2024-07-30 15:15
Modified
2024-11-21 09:32
Severity ?
Summary
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security-advisories@github.com | https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 | ||
| security-advisories@github.com | https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 | ||
| security-advisories@github.com | https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 | ||
| security-advisories@github.com | https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36 |
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Pimcore\u0027s Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10."
},
{
"lang": "es",
"value": " El paquete Admin Classic de Pimcore proporciona una interfaz de usuario backend para Pimcore. Navegar a `/admin/index/statistics` con un usuario de Pimcore conectado expone informaci\u00f3n sobre la instalaci\u00f3n de Pimcore, la versi\u00f3n de PHP, la versi\u00f3n de MYSQL, los paquetes instalados y todas las tablas de la base de datos y su recuento de filas en el sistema. Esta vulnerabilidad se solucion\u00f3 en 1.5.2, 1.4.6 y 1.3.10."
}
],
"id": "CVE-2024-41109",
"lastModified": "2024-11-21T09:32:15.027",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2024-07-30T15:15:12.890",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…