PT-2014-4957 · Php+3 · Php+3

Published 2014-04-21 · Updated 2022-05-17 · CVE-2014-2921

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.0.0

Description The issue concerns the getObjectByToken function in the Pimcore Tool Newsletter module, which does not properly handle objects obtained from unserializing Lucene search data. This allows remote attackers to conduct PHP object injection attacks, potentially leading to the execution of arbitrary code. The attack vectors involve a Zend Pdf ElementFactory Proxy object and a pathname with a trailing 0 character.

Recommendations For pimcore versions 1.4.9 through 2.0.0, consider disabling the getObjectByToken function in the Pimcore Tool Newsletter module as a temporary workaround until a patch is available. Restrict access to the Newsletter.php file to minimize the risk of exploitation. Avoid using the getObjectByToken function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-2921

GHSA-G7PJ-3V97-3VXP

Affected Products

Lucene

Php

Zend Pdf

Pimcore

References · 9

• 🔥 https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt · Exploit
• 🔥 https://github.com/pedrib/PoC/blob/caa03645e256a8b50f1101c983d39586ebc467ee/advisories/pimcore-2.1.0.txt · Exploit
• 🔥 https://exploit-db.com/exploits/43886 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2921 · Security Note
• http://pimcore.org/en/resources/blog/pimcore+2.2+released_b442 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g7pj-3v97-3vxp · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/commit/3cb2683e669b5644f180d362cfa9614c09bef280 · Note
• http://openwall.com/lists/oss-security/2014/04/21/1 · Note