CVE-2024-41109: Pimcore/admin ui classic bundle Pimcore Vulnerable To Disclosure Of Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fx6j-9pp6-ph36",
  "modified" : "2024-07-30T15:44:10Z",
  "published" : "2024-07-30T14:52:51Z",
  "aliases" : [ "CVE-2024-41109" ],
  "summary" : "Pimcore vulnerable to disclosure of system and database information behind /admin firewall",
  "details" : "### Summary\n\nNavigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.\n\n> The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.\n\n### Details\n\n`/admin/index/statistics` returns the following JSON-response:\n```\n{\n    {\n        \"instanceId\": \"...\",\n        \"pimcore_major_version\": 11,\n        \"pimcore_version\": \"v11.3.1\",\n        \"pimcore_hash\": \"3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008\",\n        \"pimcore_platform_version\": \"v2024.2\",\n        \"php_version\": \"8.3.8\",\n        \"mysql_version\": \"10.11.8-MariaDB-ubu2204\",\n    \"bundles\": [\n        // all installed bundles\n    ],\n    \"tables\": [\n        // all tables and their row count, e.g:\n        {\n            \"name\": \"users\",\n            \"rows\": 2\n        },\n    ]\n}\n```\n\nInformation about the Pimcore Version can also be seen here:\n\nIn a current Version:\n![[image](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)\n![[image](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)\n\nIn Pimcore Version 10.6.9:\n![[image](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)\n![[image](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)\n\n### PoC\n\n- [[Demo App](https://demo.pimcore.fun/admin)](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo\n- Watching Network-Tab in Developer-Tools and looking for `/admin/index/statistics`\n\n### Impact\n\nOnly for logged in Pimcore users possible.\n\n### Workaround and Patch\n\nWe patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.\nThis resolves navigating to `/admin/index/statistics`.\n\n```patch\ndiff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php\n--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)\n+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)\n@@ -15,6 +15,7 @@\n\nnamespace Pimcore\\Bundle\\AdminBundle\\Controller\\Admin;\n\n+use App\\Constant\\UserPermission;\nuse Doctrine\\DBAL\\Connection;\nuse Exception;\nuse Pimcore\\Analytics\\Google\\Config\\SiteConfigProvider;\n@@ -142,6 +143,12 @@\nthrow $this->createAccessDeniedHttpException();\n}\n\n+        $user = $this->tokenResolver->getUser();\n+\n+        if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n+            throw $this->createAccessDeniedException();\n+        }\n+\n// DB\ntry {\n$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES\n````\n\nFor the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:\n\n```php\n<?php\n\nnamespace App\\EventListener\\Admin;\n\nuse App\\Constant\\UserPermission;\nuse Pimcore\\Bundle\\AdminBundle\\Event\\AdminEvents;\nuse Pimcore\\Event\\Admin\\IndexActionSettingsEvent;\nuse Pimcore\\Security\\User\\TokenStorageUserResolver;\nuse Symfony\\Component\\EventDispatcher\\EventSubscriberInterface;\n\n/**\n* @deprecated and cannot be used in Pimcore 11\n*/\nclass PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface\n{\n    public function __construct(private readonly TokenStorageUserResolver $tokenResolver)\n    {\n    }\n\n    public static function getSubscribedEvents()\n    {\n        return [\n            AdminEvents::INDEX_ACTION_SETTINGS => ['onIndexActionSettingsEvent'],\n        ];\n    }\n\n    public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void\n    {\n        $user = $this->tokenResolver->getUser();\n        if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n            return;\n        }\n\n        $settings = $event->getSettings();\n        $settings['instanceId'] = '';\n        $settings['version'] = '';\n        $settings['build'] = '';\n        $event->setSettings($settings);\n    }\n}\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "pimcore/admin-ui-classic-bundle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.5.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-41109"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-07-30T14:52:51Z",
    "nvd_published_at" : "2024-07-30T15:15:12Z"
  }
}