CVE-2023-23937: Unrestricted Upload of File with Dangerous Type in Pimcore
Summary
CVE-2023-23937: Pimcore contains Unrestricted Upload of File with Dangerous Type. Affects pimcore/pimcore versions < 10.5.16. Fixed in 10.5.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pimcore is an open-source content management system (CMS) and product information management (PIM) platform. It provides a comprehensive set of tools for managing digital content, including user profiles and file uploads. Pimcore is widely used by organizations to create and manage their websites, e-commerce platforms, and digital assets. However, a vulnerability has been discovered in Pimcore's file upload functionality, which allows authenticated users to bypass content-type validation and upload malicious files.
Vulnerability Detail
The upload functionality in Pimcore's user profile update feature fails to properly validate the content-type of uploaded files. This allows authenticated users to upload HTML files with JavaScript content that can be executed in the context of the domain. The vulnerability arises from the lack of strict content-type checking, enabling an attacker to add a valid signature (e.g., GIF89) and send an invalid content-type. This can lead to various security risks, including cross-site scripting (XSS) attacks and potential data breaches.
How To Fix
Minimum fixed version
10.5.16
This is the first release that contains the fix.
composer require pimcore/pimcore:10.5.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Pimcore's file upload functionality poses a moderate security risk, allowing authenticated users to upload malicious files. To mitigate this risk, it is crucial to update Pimcore to version 10.5.16 or apply the provided patch. Regularly checking for vulnerabilities using tools like Vulert can help ensure the security of your Pimcore installation.
See every vulnerability recorded for pimcore/pimcore →
FAQ
The impact of this vulnerability is that an authenticated attacker can upload HTML files with JavaScript content, which can be executed in the context of the domain. This can lead to various security risks, including cross-site scripting (XSS) attacks and potential data breaches.
Any organization or individual using Pimcore versions prior to 10.5.16 is affected by this vulnerability. It is important to update to the latest version or apply the provided patch to mitigate the risk.
You can use the Vulert Playground at Vulert Scanner to check if your Pimcore installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will alert you if your application is vulnerable.
No, there are no known workarounds for this vulnerability. It is recommended to update to the latest version of Pimcore or apply the provided patch.
You can find more information about this vulnerability in the Pimcore advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-8xv4-jj4h-qww6/GHSA-8xv4-jj4h-qww6.json
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
