From 7f08667a09f0b218938efc732048feebb1655855 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jul 2024 14:54:24 +0000 Subject: [PATCH] Publish GHSA-fx6j-9pp6-ph36 --- .../GHSA-fx6j-9pp6-ph36.json | 76 +++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 advisories/github-reviewed/2024/07/GHSA-fx6j-9pp6-ph36/GHSA-fx6j-9pp6-ph36.json diff --git a/advisories/github-reviewed/2024/07/GHSA-fx6j-9pp6-ph36/GHSA-fx6j-9pp6-ph36.json b/advisories/github-reviewed/2024/07/GHSA-fx6j-9pp6-ph36/GHSA-fx6j-9pp6-ph36.json new file mode 100644 index 00000000000..b47e6b76755 --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-fx6j-9pp6-ph36/GHSA-fx6j-9pp6-ph36.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fx6j-9pp6-ph36", + "modified": "2024-07-30T14:52:51Z", + "published": "2024-07-30T14:52:51Z", + "aliases": [ + "CVE-2024-41109" + ], + "summary": "Pimcore vulnerable to disclosure of system and database information behind /admin firewall", + "details": "### Summary\n\nNavigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.\n\n> The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.\n\n### Details\n\n`/admin/index/statistics` returns the following JSON-response:\n```\n{\n {\n \"instanceId\": \"...\",\n \"pimcore_major_version\": 11,\n \"pimcore_version\": \"v11.3.1\",\n \"pimcore_hash\": \"3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008\",\n \"pimcore_platform_version\": \"v2024.2\",\n \"php_version\": \"8.3.8\",\n \"mysql_version\": \"10.11.8-MariaDB-ubu2204\",\n \"bundles\": [\n // all installed bundles\n ],\n \"tables\": [\n // all tables and their row count, e.g:\n {\n \"name\": \"users\",\n \"rows\": 2\n },\n ]\n}\n```\n\nInformation about the Pimcore Version can also be seen here:\n\nIn a current Version:\n![[image](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)\n![[image](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)\n\nIn Pimcore Version 10.6.9:\n![[image](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)\n![[image](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)\n\n### PoC\n\n- [[Demo App](https://demo.pimcore.fun/admin)](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo\n- Watching Network-Tab in Developer-Tools and looking for `/admin/index/statistics`\n\n### Impact\n\nOnly for logged in Pimcore users possible.\n\n### Workaround and Patch\n\nWe patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.\nThis resolves navigating to `/admin/index/statistics`.\n\n```patch\ndiff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php\n--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (revision dd81ef4c666b18c254333867a60f6ed455025076)\n+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php (date 1721225746781)\n@@ -15,6 +15,7 @@\n\nnamespace Pimcore\\Bundle\\AdminBundle\\Controller\\Admin;\n\n+use App\\Constant\\UserPermission;\nuse Doctrine\\DBAL\\Connection;\nuse Exception;\nuse Pimcore\\Analytics\\Google\\Config\\SiteConfigProvider;\n@@ -142,6 +143,12 @@\nthrow $this->createAccessDeniedHttpException();\n}\n\n+ $user = $this->tokenResolver->getUser();\n+\n+ if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n+ throw $this->createAccessDeniedException();\n+ }\n+\n// DB\ntry {\n$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES\n````\n\nFor the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:\n\n```php\n ['onIndexActionSettingsEvent'],\n ];\n }\n\n public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void\n {\n $user = $this->tokenResolver->getUser();\n if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n return;\n }\n\n $settings = $event->getSettings();\n $settings['instanceId'] = '';\n $settings['version'] = '';\n $settings['build'] = '';\n $event->setSettings($settings);\n }\n}\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "pimcore/admin-ui-classic-bundle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.5.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pimcore/admin-ui-classic-bundle" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40" + }, + { + "type": "WEB", + "url": "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-07-30T14:52:51Z", + "nvd_published_at": null + } +} \ No newline at end of file