CVE-2023-2338: SQL Injection in AssetController in pimcore/pimcore
Summary
CVE-2023-2338: SQL Injection in AssetController. Affects pimcore/pimcore versions < 10.5.21. Fixed in 10.5.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source content management system (CMS) and customer experience management (CEM) platform. It provides a wide range of features for managing digital assets, content, and customer data. The AssetController is a component of Pimcore that handles the management and retrieval of assets such as images, videos, and documents. Unfortunately, a SQL injection vulnerability has been discovered in the AssetController, which can allow an attacker to manipulate the backend database and potentially gain unauthorized access or cause data corruption.
Vulnerability Detail
The SQL injection vulnerability in the AssetController is caused by unsanitized concatenation of strings in the where clause. This allows an attacker to inject malicious SQL code into the query, leading to various security risks. An attacker exploiting this vulnerability can potentially dump the entire database, alter data, or perform denial-of-service attacks on the backend database. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-89.
How To Fix
Minimum fixed version
10.5.21
This is the first release that contains the fix.
composer require pimcore/pimcore:10.5.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating or patching the software is not immediately feasible, you can apply the patch manually by following the instructions in the patch file available at https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520.patch. However, it is strongly recommended to update to the latest version as soon as possible to mitigate the vulnerability effectively.
Conclusion
The SQL injection vulnerability in the AssetController of pimcore/pimcore can have severe consequences, including unauthorized access to the backend database and data manipulation. It is crucial to update to version 10.5.21 or apply the provided patch as soon as possible to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pimcore/pimcore →
FAQ
The SQL injection vulnerability in the AssetController can allow an attacker to gain unauthorized access to the backend database, manipulate data, or cause denial-of-service attacks.
You can fix this vulnerability by updating to version 10.5.21 of pimcore/pimcore or manually applying the provided patch.
Yes, you can apply the patch manually if updating or patching the software is not immediately feasible. However, updating to the latest version is strongly recommended.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to address the vulnerability promptly to prevent potential attacks.
You can find more information about this vulnerability, including the patch and its impact, in the official advisory at https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462/
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
