PT-2023-20587 · Pimcore · Pimcore/Customer-Data-Framework

Mcop1 · Publicado 2023-05-10 · Atualizado 2023-05-31 · CVE-2023-2629

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 3.3.9

Description The issue concerns improper neutralization of formula elements in a CSV file, which can lead to formula injection or CSV injection. This vulnerability affects input fields such as Firstname, Lastname, Street, Zip, and City, allowing unauthenticated attackers to execute arbitrary code via a crafted Excel file. Successful exploitation can result in client-sided command injection, code execution, or remote ex-filtration of confidential data.

Recommendations For versions prior to 3.3.9, update to version 3.3.9 to resolve the issue. As a temporary workaround, consider applying the patch manually from https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-1236

Identificadores relacionados

CVE-2023-2629

GHSA-MQ3X-QGWX-3RFW

Produtos afetados

Pimcore/Customer-Data-Framework

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2629.json · Exploit
• 🔥 https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01 · Exploit
• https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803 · Correção
• https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-mq3x-qgwx-3rfw · Nota
• https://github.com/pimcore/customer-data-framework · Nota
• https://t.me/cvenotify/51470 · Publicação no Telegram
• https://t.me/cvenotify/50678 · Publicação no Telegram
• https://t.me/cibsecurity/63817 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2629 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mq3x-qgwx-3rfw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-2629 · Aviso do Fabricante