CVE-2024-11954

Executive Summary

CVE-2024-11954 is a stored cross-site scripting (XSS) vulnerability affecting Pimcore, an open-source enterprise content management and product information management platform. The flaw resides in the Data Object Classification Store functionality, where insufficient input sanitization allows an authenticated attacker to inject malicious JavaScript code. When other users view the affected data, the injected script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise of the Pimcore instance. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the exploit details, a more realistic score is 5.4 (Medium). A public proof-of-concept (PoC) exploit is available, and no official patch was initially confirmed, but the vendor has since released fixes in versions 10.5.21 and 11.1.1.

Supply Chain & Package Security

Pimcore is a PHP-based application distributed via GitHub and Composer. The vulnerability affects the core application, not a third-party package. Organizations using Pimcore should verify their version and apply the patch immediately. No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs authenticated access to the Classification Store.
• User Interaction: Required (UI:R) – victim must view the malicious data.
• Scope: Changed (S:C) – the vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited ability to modify data.
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the public availability of a PoC and the potential for chaining with other vulnerabilities elevate the threat.

Deep Dive & Mechanics

The vulnerability exists in the Search Document component of Pimcore, specifically within the Data Object Classification Store. The Classification Store allows users to define and assign key-value pairs to data objects. When a key is created or edited, the application fails to properly sanitize the input before storing it in the database. When the data is later rendered in the backend or frontend, the unsanitized input is interpreted as HTML/JavaScript, leading to stored XSS.

The attack flow:

1. An authenticated attacker with access to the Classification Store navigates to the key management interface.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a key value.
3. The payload is stored in the database without proper encoding.
4. When another user (e.g., an administrator) views the affected data object or searches for documents, the payload executes in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the application.

The root cause is the lack of output encoding when rendering user-supplied data in the Classification Store interface. The application should use context-appropriate escaping (e.g., HTML entity encoding) to prevent script execution.

Vulnerable vs. Patched Code

Vulnerable Code (Pimcore < 10.5.21 / < 11.1.1): The vulnerable code likely exists in the template or controller that renders the Classification Store key values. For example, in a Twig template:

{{ key.value }}

This directly outputs the value without escaping.

Patched Code (Pimcore >= 10.5.21 / >= 11.1.1): The patched code uses Twig's escape filter or the e filter to HTML-encode the output:

{{ key.value|escape('html') }}

Or in PHP:

echo htmlspecialchars($key->getValue(), ENT_QUOTES, 'UTF-8');

This ensures that any HTML/JavaScript in the value is rendered as text, not executed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Pimcore instance (version < 10.5.21 or < 11.1.1).
• Valid credentials for a user with access to the Data Object Classification Store.

Exploit Steps:

1. Log in to the Pimcore backend.
2. Navigate to Data Objects -> Classification Store -> Keys.
3. Create a new key or edit an existing one.
4. In the Name or Value field, inject the following payload:

   <script>alert(document.cookie)</script>
   

5. Save the key.
6. As a victim user, navigate to any data object that uses this classification store key. The script will execute, displaying the victim's cookies.

Using the Exploit-DB Code: The provided exploit code is a textual description and PoC. To automate, an attacker could use a tool like curl or a custom script:

curl -X POST "https://target.pimcore/admin/classificationstore/key/save" \
  -H "Cookie: PHPSESSID=your_session_id" \
  -d "keyId=123&name=<script>alert('XSS')</script>"

Note: The exact endpoint and parameters may vary. The attacker must first obtain a valid session and determine the correct API endpoints.

Blue Team

Detection:

• Monitor for unusual POST requests to /admin/classificationstore/key/save or similar endpoints.
• Look for payloads containing <script>, onerror, onload, or other XSS vectors in the request body.
• Review server logs for 200 responses to these endpoints followed by 404/500 errors from other users.

Hunting:

• Search the database for stored XSS patterns in the classificationstore_keys table:

  SELECT * FROM classificationstore_keys WHERE name LIKE '%<script>%' OR value LIKE '%<script>%';
  

• Use a web application firewall (WAF) to block common XSS payloads.

Containment:

• If exploitation is suspected, immediately revoke the attacker's session and reset their credentials.
• Remove the malicious key from the Classification Store.
• Apply the patch by upgrading to Pimcore 10.5.21 or 11.1.1.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /admin/classificationstore/key/save with payloads containing <script>, onerror, onload, javascript:, etc.
  • Unusual user-agent strings or IP addresses accessing the Classification Store.

• Host IOCs:

  • Presence of <script> tags in the classificationstore_keys table in the database.
  • Unexpected JavaScript execution in the browser when viewing data objects.

• File IOCs:

  • Modified or new files in the Pimcore installation directory (though unlikely for this XSS).

Detection Engineering

YARA Rule

rule CVE_2024_11954_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting Pimcore Classification Store"
        author = "Valters IT"
        date = "2025-01-28"
        reference = "CVE-2024-11954"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:\s*/is
    condition:
        any of them
}

Sigma Rule

title: Pimcore Classification Store Stored XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-11954 by injecting XSS payloads into the Classification Store
author: Valters IT
date: 2025-01-28
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/classificationstore/key/save'
        cs-body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in key names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11954 Pimcore Classification Store XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/classificationstore/key/save"; http_uri; content:"<script>"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Pimcore: Update to version 10.5.21 or 11.1.1 or later. These versions include proper output encoding for the Classification Store.
2. Apply Virtual Patching: If immediate upgrade is not possible, use a WAF to block requests containing XSS payloads to the Classification Store endpoints.
3. Review User Permissions: Restrict access to the Classification Store to only trusted administrators.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to mitigate the impact of XSS even if a vulnerability is exploited.
• Conduct regular security audits and penetration testing of the Pimcore instance.
• Enable input validation and output encoding in all custom Pimcore extensions.

Valters IT Signature This report was generated by Valters IT DevSecOps AI Assistant. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: FA8704D91B797A0996789B3A] */}