{"id":"GHSA-fx6j-9pp6-ph36","summary":"Pimcore vulnerable to disclosure of system and database information behind /admin firewall","details":"### Summary\n\nNavigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.\n\n\u003e The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.\n\n### Details\n\n`/admin/index/statistics` returns the following JSON-response:\n```\n{\n    {\n        \"instanceId\": \"...\",\n        \"pimcore_major_version\": 11,\n        \"pimcore_version\": \"v11.3.1\",\n        \"pimcore_hash\": \"3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008\",\n        \"pimcore_platform_version\": \"v2024.2\",\n        \"php_version\": \"8.3.8\",\n        \"mysql_version\": \"10.11.8-MariaDB-ubu2204\",\n    \"bundles\": [\n        // all installed bundles\n    ],\n    \"tables\": [\n        // all tables and their row count, e.g:\n        {\n            \"name\": \"users\",\n            \"rows\": 2\n        },\n    ]\n}\n```\n\nInformation about the Pimcore Version can also be seen here:\n\nIn a current Version:\n![[image](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)\n![[image](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)\n\nIn Pimcore Version 10.6.9:\n![[image](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)\n![[image](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)\n\n### PoC\n\n- [[Demo App](https://demo.pimcore.fun/admin)](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo\n- Watching Network-Tab in Developer-Tools and looking for `/admin/index/statistics`\n\n### Impact\n\nOnly for logged in Pimcore users possible.\n\n### Workaround and Patch\n\nWe patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.\nThis resolves navigating to `/admin/index/statistics`.\n\n```patch\ndiff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php\n--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)\n+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)\n@@ -15,6 +15,7 @@\n\nnamespace Pimcore\\Bundle\\AdminBundle\\Controller\\Admin;\n\n+use App\\Constant\\UserPermission;\nuse Doctrine\\DBAL\\Connection;\nuse Exception;\nuse Pimcore\\Analytics\\Google\\Config\\SiteConfigProvider;\n@@ -142,6 +143,12 @@\nthrow $this-\u003ecreateAccessDeniedHttpException();\n}\n\n+        $user = $this-\u003etokenResolver-\u003egetUser();\n+\n+        if (!$user-\u003eisAdmin() && !$user-\u003eisAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n+            throw $this-\u003ecreateAccessDeniedException();\n+        }\n+\n// DB\ntry {\n$tables = $db-\u003efetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES\n````\n\nFor the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions \u003c Pimcore 11:\n\n```php\n\u003c?php\n\nnamespace App\\EventListener\\Admin;\n\nuse App\\Constant\\UserPermission;\nuse Pimcore\\Bundle\\AdminBundle\\Event\\AdminEvents;\nuse Pimcore\\Event\\Admin\\IndexActionSettingsEvent;\nuse Pimcore\\Security\\User\\TokenStorageUserResolver;\nuse Symfony\\Component\\EventDispatcher\\EventSubscriberInterface;\n\n/**\n* @deprecated and cannot be used in Pimcore 11\n*/\nclass PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface\n{\n    public function __construct(private readonly TokenStorageUserResolver $tokenResolver)\n    {\n    }\n\n    public static function getSubscribedEvents()\n    {\n        return [\n            AdminEvents::INDEX_ACTION_SETTINGS =\u003e ['onIndexActionSettingsEvent'],\n        ];\n    }\n\n    public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void\n    {\n        $user = $this-\u003etokenResolver-\u003egetUser();\n        if ($user-\u003eisAdmin() || $user-\u003eisAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n            return;\n        }\n\n        $settings = $event-\u003egetSettings();\n        $settings['instanceId'] = '';\n        $settings['version'] = '';\n        $settings['build'] = '';\n        $event-\u003esetSettings($settings);\n    }\n}\n```","aliases":["CVE-2024-41109"],"modified":"2024-07-30T16:37:26.218094Z","published":"2024-07-30T14:52:51Z","related":["CVE-2024-41109"],"database_specific":{"severity":"MODERATE","nvd_published_at":"2024-07-30T15:15:12Z","github_reviewed":true,"github_reviewed_at":"2024-07-30T14:52:51Z","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41109"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"},{"type":"PACKAGE","url":"https://github.com/pimcore/admin-ui-classic-bundle"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"}],"affected":[{"package":{"name":"pimcore/admin-ui-classic-bundle","ecosystem":"Packagist","purl":"pkg:composer/pimcore/admin-ui-classic-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2"}]}],"versions":["1.4.0","v1.0.0","v1.0.0-BETA1","v1.0.0-RC1","v1.0.0-RC2","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.1.0","v1.1.0-RC1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.2","v1.2.0-RC1","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.0-RC1","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.5.0","v1.5.0-RC1","v1.5.0-RC2","v1.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-fx6j-9pp6-ph36/GHSA-fx6j-9pp6-ph36.json","last_known_affected_version_range":"\u003c= 1.5.1"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}