PT-2023-20587 · Pimcore · Pimcore/Customer-Data-Framework

Mcop1 · Published 2023-05-10 · Updated 2023-05-31 · CVE-2023-2629

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 3.3.9

Description The issue concerns improper neutralization of formula elements in a CSV file, which can lead to formula injection or CSV injection. This vulnerability affects input fields such as Firstname, Lastname, Street, Zip, and City, allowing unauthenticated attackers to execute arbitrary code via a crafted Excel file. Successful exploitation can result in client-sided command injection, code execution, or remote ex-filtration of confidential data.

Recommendations For versions prior to 3.3.9, update to version 3.3.9 to resolve the issue. As a temporary workaround, consider applying the patch manually from https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-2629

GHSA-MQ3X-QGWX-3RFW

Affected Products

Pimcore/Customer-Data-Framework

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2629.json · Exploit
• 🔥 https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01 · Exploit
• https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-2629 · Security Note
• https://osv.dev/vulnerability/GHSA-mq3x-qgwx-3rfw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2629 · Vendor Advisory
• https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-mq3x-qgwx-3rfw · Note
• https://github.com/pimcore/customer-data-framework · Note
• https://t.me/cvenotify/51470 · Telegram Post
• https://t.me/cvenotify/50678 · Telegram Post
• https://t.me/cibsecurity/63817 · Telegram Post