PT-2014-4958 · Zend+1 · Zend Http Response Stream+1

Published 2014-04-21 · Updated 2014-04-22 · CVE-2014-2922

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.1.0

Description The issue concerns the getObjectByToken function in Newsletter.php within the Pimcore Tool Newsletter module. It fails to properly handle an object obtained by unserializing a pathname, allowing remote attackers to conduct PHP object injection attacks. This can lead to the deletion of arbitrary files via vectors involving a Zend Http Response Stream object.

Recommendations For pimcore versions 1.4.9 through 2.1.0, consider disabling the getObjectByToken function in Newsletter.php until a patch is available to prevent PHP object injection attacks. Restrict access to the Pimcore Tool Newsletter module to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-2922

Affected Products

Zend Http Response Stream

Pimcore

References · 6

• 🔥 https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt · Exploit
• 🔥 https://exploit-db.com/exploits/43886 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2922 · Security Note
• http://pimcore.org/en/resources/blog/pimcore+2.2+released_b442 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2922 · Note
• http://openwall.com/lists/oss-security/2014/04/21/1 · Note