CVE-2022-39365: RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
Summary
CVE-2022-39365: RCE vulnerability in Pimcore/Mail & Dynamic Text Layout. Affects pimcore/pimcore versions < 10.5.9. Fixed in 10.5.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source platform for managing digital experiences. It provides a wide range of features for building and managing websites, digital assets, and customer experiences. The Pimcore/Mail component is responsible for handling email templates, while the ClassDefinition/Layout/Text component manages dynamic text layout. These components are vulnerable to a server-side template injection remote code execution (RCE) attack.
Vulnerability Detail
The user-controlled twig templates rendering in Pimcore/Mail & ClassDefinition/Layout/Text is vulnerable to server-side template injection RCE. This means that an attacker can inject malicious code into the templates, which will be executed on the server when the templates are rendered. This can lead to arbitrary code execution, allowing the attacker to take control of the server and potentially access or modify sensitive data. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
10.5.9
This is the first release that contains the fix.
composer require pimcore/pimcore:10.5.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating or applying the patch is not immediately feasible, you can manually apply the patch provided at https://github.com/pimcore/pimcore/pull/13347.patch. This workaround will mitigate the vulnerability and prevent the server-side template injection RCE.
Conclusion
The RCE vulnerability in Pimcore/Mail & Dynamic Text Layout allows an attacker to execute arbitrary code on the server by injecting malicious code into user-controlled twig templates. It is critical to update to version 10.5.9 or apply the provided patch to mitigate this vulnerability. If immediate updating or patching is not possible, the workaround can be applied. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
Pimcore is an open-source platform for managing digital experiences. It provides features for building and managing websites, digital assets, and customer experiences.
Server-side template injection is a vulnerability that allows an attacker to inject malicious code into templates that are processed on the server. This can lead to arbitrary code execution.
Remote code execution is a vulnerability that allows an attacker to execute arbitrary code on a target system. In the context of this vulnerability, it means that an attacker can execute code on the server hosting the Pimcore application.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
You can use Vulert's playground at Vulert Scanner to check if your Pimcore installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
