CVE-2024-41109: Pimcore admin-ui-classic-bundle - Disclosure of System and Database Information
Summary
CVE-2024-41109: Pimcore vulnerable to disclosure of system and database information behind /admin firewall. Affects pimcore/admin-ui-classic-bundle versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pimcore admin-ui-classic-bundle is a package that provides the classic user interface for the Pimcore content management system. It allows users to manage and control various aspects of their Pimcore installation, including system and database information. However, a vulnerability in the bundle exposes this sensitive information to logged-in Pimcore users.
Vulnerability Detail
By navigating to the '/admin/index/statistics' endpoint with a logged-in Pimcore user, an attacker can obtain detailed information about the Pimcore installation. This includes the Pimcore version, PHP version, MySQL version, installed bundles, and all database tables along with their row counts. This information disclosure can aid attackers in planning further attacks or exploiting known vulnerabilities in specific versions of Pimcore, PHP, or MySQL.
How To Fix
Minimum fixed version
1.5.2
This is the first release that contains the fix.
composer require pimcore/admin-ui-classic-bundle:1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of the admin-ui-classic-bundle is not immediately possible, a workaround can be implemented by adding a custom check in the IndexController.php file. This check should ensure that only users with the necessary permissions can access the '/admin/index/statistics' endpoint. Here is an example of the patch:
diff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php
--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php
+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php
@@ -15,6 +15,7 @@
namespace Pimcore\Bundle\AdminBundle\Controller\Admin;
+use App\Constant\UserPermission;
use Doctrine\DBAL\Connection;
use Exception;
use Pimcore\Analytics\Google\Config\SiteConfigProvider;
@@ -142,6 +143,12 @@
throw $this->createAccessDeniedHttpException();
}
+ $user = $this->tokenResolver->getUser();
+
+ if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {
+ throw $this->createAccessDeniedException();
+ }
+
// DB
try {
$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES
This patch adds a check for the 'ADMIN_INDEX_VIEW' permission before allowing access to the '/admin/index/statistics' endpoint.
Conclusion
The Pimcore admin-ui-classic-bundle is vulnerable to an information disclosure issue that exposes system and database information to logged-in Pimcore users. This vulnerability has been patched in version 1.5.2 of the bundle. It is crucial to update to the latest version or apply the provided workaround to mitigate the risk of information exposure.
See every vulnerability recorded for pimcore/admin-ui-classic-bundle →
FAQ
The impact of this vulnerability is limited to logged-in Pimcore users. However, it can provide valuable information to attackers, such as the Pimcore version, PHP version, MySQL version, and the structure of the database. This information can be used to plan further attacks or exploit known vulnerabilities in specific versions of Pimcore, PHP, or MySQL.
Any Pimcore installation using a version of the admin-ui-classic-bundle prior to 1.5.2 is affected by this vulnerability. It is recommended to update to the latest version to mitigate the risk.
You can check if your Pimcore installation is vulnerable by accessing the '/admin/index/statistics' endpoint with a logged-in Pimcore user. If you receive a JSON response containing detailed system and database information, your installation is vulnerable.
Yes, a workaround is available by adding a custom check in the IndexController.php file. This check should ensure that only users with the necessary permissions can access the '/admin/index/statistics' endpoint. Please refer to the 'workaround' section for more details.
Yes, the Pimcore admin-ui-classic-bundle has been patched to address this vulnerability. It is recommended to update to version 1.5.2 or later to apply the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/admin-ui-classic-bundle.
