PT-2021-15444 · Pimcore · Pimcore

Daniele Scanu · Published 2021-02-18 · Updated 2021-02-25 · CVE-2021-23340

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions prior to 6.8.8

Description A Local File Inclusion issue exists in the downloadCsvAction function of the CustomReportController class. This can be reached by an authenticated user through a GET request at the endpoint "/admin/reports/custom-report/download-csv?exportFile=filename". The exportFile variable is not sanitized, allowing an attacker to exploit this issue.

Recommendations For versions prior to 6.8.8, update to version 6.8.8 or later to resolve the issue. As a temporary workaround, consider disabling the downloadCsvAction function in the CustomReportController class until a patch is available. Restrict access to the /admin/reports/custom-report/download-csv endpoint to minimize the risk of exploitation. Avoid using the exportFile variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-23340

GHSA-H7F9-CVH5-QW7F

SNYK-PHP-PIMCOREPIMCORE-1070132

Affected Products

Pimcore

References · 7

• 🔥 https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1070132 · Exploit
• https://github.com/pimcore/pimcore/commit/1786bdd4962ee51544fad537352c2b4223309442 · Patch
• https://osv.dev/vulnerability/CVE-2021-23340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23340 · Security Note
• https://osv.dev/vulnerability/GHSA-h7f9-cvh5-qw7f · Vendor Advisory
• https://github.com/pimcore/pimcore/blob/v6.7.2/bundles/AdminBundle/Controller/Reports/CustomReportController.php%23L454 · Note
• https://t.me/cibsecurity/23812 · Telegram Post