Skip to content

Disclosed system and database information behind /admin firewall

Moderate
wisconaut published GHSA-fx6j-9pp6-ph36 Jul 30, 2024

Package

composer pimcore/admin-ui-classic-bundle (Composer)

Affected versions

<=1.5.1

Patched versions

1.5.2
pimcore/ee-admin-ui-classic-bundle
<=1.3.9
<=1.4.5
<=1.5.1
1.3.10
1.4.6
1.5.2

Description

Summary

Navigating to /admin/index/statistics with a logged in Pimcore user (not an XmlHttpRequest because of this check: IndexController:125) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.

The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.

Details

/admin/index/statistics returns the following JSON-response:

{
    {
        "instanceId": "...",
        "pimcore_major_version": 11,
        "pimcore_version": "v11.3.1",
        "pimcore_hash": "3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008",
        "pimcore_platform_version": "v2024.2",
        "php_version": "8.3.8",
        "mysql_version": "10.11.8-MariaDB-ubu2204",
    "bundles": [
        // all installed bundles
    ],
    "tables": [
        // all tables and their row count, e.g:
        {
            "name": "users",
            "rows": 2
        },
    ]
}

Information about the Pimcore Version can also be seen here:

In a current Version:
image
image

In Pimcore Version 10.6.9:
image
image

PoC

Impact

Only for logged in Pimcore users possible.

Workaround and Patch

We patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.
This resolves navigating to /admin/index/statistics.

diff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php
--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)
+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)
@@ -15,6 +15,7 @@

namespace Pimcore\Bundle\AdminBundle\Controller\Admin;

+use App\Constant\UserPermission;
use Doctrine\DBAL\Connection;
use Exception;
use Pimcore\Analytics\Google\Config\SiteConfigProvider;
@@ -142,6 +143,12 @@
throw $this->createAccessDeniedHttpException();
}

+        $user = $this->tokenResolver->getUser();
+
+        if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
+            throw $this->createAccessDeniedException();
+        }
+
// DB
try {
$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES

For the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:

<?php

namespace App\EventListener\Admin;

use App\Constant\UserPermission;
use Pimcore\Bundle\AdminBundle\Event\AdminEvents;
use Pimcore\Event\Admin\IndexActionSettingsEvent;
use Pimcore\Security\User\TokenStorageUserResolver;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;

/**
* @deprecated and cannot be used in Pimcore 11
*/
class PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface
{
    public function __construct(private readonly TokenStorageUserResolver $tokenResolver)
    {
    }

    public static function getSubscribedEvents()
    {
        return [
            AdminEvents::INDEX_ACTION_SETTINGS => ['onIndexActionSettingsEvent'],
        ];
    }

    public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void
    {
        $user = $this->tokenResolver->getUser();
        if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
            return;
        }

        $settings = $event->getSettings();
        $settings['instanceId'] = '';
        $settings['version'] = '';
        $settings['build'] = '';
        $event->setSettings($settings);
    }
}

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVE ID

CVE-2024-41109

Weaknesses

Credits