Pimcore admin-ui-classic-bundle up to 1.2.2 injection

Summaryinfo

A vulnerability categorized as very critical has been discovered in Pimcore admin-ui-classic-bundle up to 1.2.2. This impacts an unknown function. Such manipulation leads to injection. This vulnerability is listed as CVE-2024-23648. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Pimcore admin-ui-classic-bundle up to 1.2.2. It has been rated as very critical. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able to retrieve it would be able to resets the user's password. Prior to version 1.2.3, the reset-password URL is crafted using the "Host" HTTP header of the request sent to request a password reset. This way, an external attacker could send password requests for users, but specify a "Host" header of a website that they control. If the user receiving the mail clicks on the link, the attacker would retrieve the reset token of the victim and perform account takeover. Version 1.2.3 fixes this issue.

The weakness was presented 01/24/2024 as GHSA-mrqg-mwh7-q94j. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-23648 since 01/19/2024. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/24/2024). The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 1.2.3 eliminates this vulnerability. Applying the patch 70f2205b5a5ea9584721d4f3e803f4d0dd5e4655 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Information Management Software

Vendor

• Pimcore

Name

• admin-ui-classic-bundle

Version

• 1.2.0
• 1.2.1
• 1.2.2

License

• open-source

Website

• Product: https://github.com/pimcore/admin-ui-classic-bundle/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion