Stored XSS Vulnerability in Pimcore PDF Upload Functionality
Summary
GHSA-xr3m-6gq6-22cg: Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document. Affects pimcore/pimcore versions >= 11.4.2, < 11.5.3. Fixed in 11.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pimcore is an open-source digital experience platform that enables users to manage and deliver content across various channels. It provides functionalities for content management, digital asset management, and e-commerce. However, the platform has a vulnerability in its PDF upload feature, which allows for the injection of malicious scripts through improperly sanitized content.
Vulnerability Detail
A Stored Cross-Site Scripting (XSS) vulnerability exists in the PDF upload functionality of Pimcore. This flaw allows attackers to upload a PDF file containing embedded scripts that execute when the document is viewed. The vulnerability arises from the application's failure to adequately sanitize the uploaded content, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information. The affected code is located in the file handling and rendering logic of the PDF upload feature, making it a significant security risk for users who interact with the malicious PDF.
How To Fix
Minimum fixed version
11.5.3
This is the first release that contains the fix.
composer require pimcore/pimcore:11.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the PDF upload functionality until the vulnerability is patched. Additionally, implement strict content security policies to mitigate the risk of executing malicious scripts.
Conclusion
The Stored XSS vulnerability in Pimcore's PDF upload functionality poses a significant risk to users, allowing for the execution of malicious scripts. It is crucial to update the package to the latest version to mitigate this risk. Users should also consider using Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for pimcore/pimcore →
FAQ
Stored XSS is a type of security vulnerability where an attacker is able to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected content.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your composer.lock file without needing to sign up.
The potential impacts include session hijacking, unauthorized access to sensitive information, and defacement of web pages, which can compromise user trust and data integrity.
Yes, a patch is available. Update the Pimcore package to the latest version using 'composer update pimcore/pimcore' to mitigate the vulnerability.
If immediate updates are not possible, consider disabling the PDF upload functionality and implementing strict content security policies to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
