CVE-2024-21667: Pimcore Customer Data Framework Improper Access Control

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Pimcore Customer Data Framework is a package that provides functionality for managing customer data in the Pimcore administration panel. It allows administrators to store and query customer information, including personally identifiable information (PII). However, a vulnerability has been discovered in the framework that allows an authenticated and unauthorized user to access the GDPR data extraction feature and query the returned information, leading to customer data exposure.

Vulnerability Detail

The vulnerability arises from the lack of enforcement of permissions when accessing the /admin/customermanagementframework/gdpr-data/search-data-objects endpoint. Even users without the necessary permissions can access the endpoint and query the available data. This issue can be traced to a specific code location in the GDPRDataController.php file of the Customer Data Framework. As a result, an unauthorized user can access PII data from customers without proper authorization, potentially violating data protection regulations such as GDPR.

composer require pimcore/customer-management-framework-bundle:4.0.6

Workaround

As a temporary workaround, administrators can manually enforce access control by modifying the code in the GDPRDataController.php file. Specifically, the access control check should be added at the mentioned code location to ensure that only users with the appropriate permissions can access the GDPR data extraction feature. Here is an example of how the code modification can be done:

// Add the following code snippet at line 38 of GDPRDataController.php
if (!$this->isGranted('ROLE_ADMIN')) {
    throw $this->createAccessDeniedException('Access Denied.');
}

Please note that this workaround is not recommended as it involves modifying the core framework code, which can introduce maintenance and compatibility issues. It is strongly advised to apply the official fix by updating to the latest version of the framework.

Conclusion

The Pimcore Customer Data Framework is vulnerable to improper access control, allowing unauthorized users to access and query customer data. To mitigate this vulnerability, it is crucial to update the framework to version 4.0.6 or later, which includes the necessary access control enforcement. Administrators can also apply a temporary workaround by manually modifying the code, but this is not recommended due to potential maintenance and compatibility issues. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for pimcore/customer-management-framework-bundle →

FAQ