PT-2024-24927 · Pimcore · Pimcore
Dandanx
+1
·
Published
2024-06-04
·
Updated
2024-06-10
·
CVE-2024-32871
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Pimcore versions prior to 11.2.4
Description
The Pimcore thumbnail generation can be exploited to flood the server with large files. Attackers can create files that are much larger in file size than the original by changing the file extension or scaling factor of the requested thumbnail. All Imagick supported file formats can be served without filtering, allowing attackers to create files in various formats, including text representations of images. This can lead to exposure of private data, such as GPS information in user-uploaded images. Additionally, the vulnerability can be used to create duplicated files on the server with arbitrary file formats. The scaling factor is not limited and can be modified via URL, allowing attackers to create new files with each request and potentially max out the CPU.
Recommendations
For versions prior to 11.2.4, implement a list of allowed formats that the developer can modify if needed, and return an error or a 404 for unsupported formats. Limit scale factors with an allowlist to prevent exploitation. For non-maintained Pimcore versions, consider using webserver configuration to only serve allowed files. As a temporary workaround, consider disabling the thumbnail generation feature until a patch is available. Restrict access to the vulnerable thumbnail endpoint to minimize the risk of exploitation. Avoid using arbitrary file formats and scaling factors in thumbnail requests until the issue is resolved.
Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pimcore