PT-2023-30527 · Pimcore · Pimcore

Dvesh3 + 1 · Published 2023-11-15 · Updated 2023-11-22 · CVE-2023-47637

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.1.1

Description The issue allows backend users with basic permissions to execute arbitrary SQL statements by passing input directly into an SQL statement through the /admin/object/grid-proxy endpoint. This is due to the getFilterCondition() function, specifically in the Multiselect implementation, not normalizing, escaping, or validating the passed value. As a result, any backend user can alter data or escalate their privileges to at least admin level. There are no known workarounds for this issue.

Recommendations For versions prior to 11.1.1, update to version 11.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the /admin/object/grid-proxy endpoint and the Multiselect field to minimize the risk of exploitation. Avoid using the filter parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-47637

GHSA-72HH-XF79-429P

Affected Products

Pimcore

References · 10

• 🔥 https://github.com/pimcore/pimcore/security/advisories/GHSA-72hh-xf79-429p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47637.json · Exploit
• https://github.com/pimcore/pimcore/commit/d164d99c90f098d0ccd6b72929c48b727e2953a0 · Patch
• https://osv.dev/vulnerability/GHSA-72hh-xf79-429p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47637 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47637 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/blob/42b6cfa77c4540205bdd10689893ccb73e4bac8f/models/DataObject/ClassDefinition/Data/Multiselect.php#L285-L312 · Note
• https://github.com/pimcore/admin-ui-classic-bundle/blob/bba7c7419cb1f06d5fd98781eab4d6995e4e5dca/src/Helper/GridHelperService.php#L311 · Note
• https://t.me/latest_high_impact_cve/94 · Telegram Post