CVE-2024-32871: Flooding Server with Thumbnail files in Pimcore
Summary
CVE-2024-32871: Flooding Server with Thumbnail files. Affects pimcore/pimcore versions >= 11.0.0, < 11.2.4. Fixed in 11.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source content management system that allows users to manage digital assets, create web pages, and handle e-commerce functionalities. It supports various file formats for thumbnail generation using the Imagick library. However, the thumbnail endpoint in Pimcore does not filter the file formats, making it vulnerable to abuse. This vulnerability can lead to the flooding of the server with large files, exposing private data and potentially causing resource exhaustion.
Vulnerability Detail
The vulnerability in Pimcore has multiple aspects:
-
All Imagick supported file formats are served without filtering: The thumbnail endpoint does not check for allowed formats, allowing the generation of files in any format supported by Imagick. This includes formats like text, YAML, JSON, and more. Attackers can exploit this to generate files much larger than the original thumbnails, potentially filling up the server's storage space and exposing private data.
-
Non web-optimized file formats create duplicated files on the server: Thumbnail configurations that serve non web-optimized file formats can be abused to create arbitrary files with different extensions. Each request creates a new copy of the original thumbnail file, leading to potential resource exhaustion.
-
Scaling factor is not limited and can be modified via URL: Attackers can modify the scaling factor in the request URL to scale thumbnails to arbitrary sizes. This can result in the creation of numerous files and potential CPU exhaustion. Combining this with the first vulnerability allows the generation of large text files for scaled images.
How To Fix
Minimum fixed version
11.2.4
This is the first release that contains the fix.
composer require pimcore/pimcore:11.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerabilities in Pimcore related to thumbnail generation can have severe consequences, including resource exhaustion and potential exposure of private data. It is crucial for Pimcore users to apply the recommended fixes and update to the fixed version (11.2.4) to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
These vulnerabilities in Pimcore can lead to resource exhaustion, filling up the server's storage space, and potential exposure of private data. It can also result in CPU overload in certain scenarios.
As far as we can see, all Pimcore instances are affected by these vulnerabilities. The fixed version is 11.2.4.
Yes, these vulnerabilities can be exploited remotely by sending malicious requests to the affected Pimcore instances.
Implementing the recommended fixes mentioned in the 'how_to_fix' section can mitigate these vulnerabilities in Pimcore.
Yes, the CVSS score for these vulnerabilities is 7.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
