CVE-2024-23646

Executive Summary

CVE-2024-23646 is a critical SQL Injection vulnerability in the Pimcore Admin Classic Bundle, a backend user interface for the Pimcore content management platform. The flaw resides in the selectedIds parameter, which is used when creating zip files from available files. An authenticated backend user with very basic permissions can exploit this to execute arbitrary SQL statements, leading to data exfiltration, data manipulation, and privilege escalation to admin level. The vulnerability affects versions prior to 1.3.2. The CVSS score is 8.8 (High), and the EPSS probability is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept code or exploit templates are available.

Supply Chain & Package Security

This vulnerability is in the Pimcore Admin Classic Bundle, a PHP package distributed via Composer. Organizations using Pimcore should verify their dependency version and update to 1.3.2 or later. The package is not directly available on NPM, PyPI, Go, or Ruby registries.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated backend user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is High due to the low complexity, low privileges required, and the potential for complete compromise of the Pimcore instance.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the selectedIds parameter. The Pimcore Admin Classic Bundle provides functionality to create zip archives from selected files. The selectedIds parameter is used to pass the IDs of the files to be included. The application fails to properly sanitize or parameterize this input before using it in a SQL query.

An attacker can inject SQL commands by crafting a malicious selectedIds value. For example, a payload like 1 UNION SELECT ... could be used to extract data from other tables, modify user permissions, or create new admin users.

The injection point is likely in a function that constructs a SQL query like:

SELECT * FROM assets WHERE id IN (selectedIds)

Without proper parameterization, the attacker can break out of the intended query structure.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.3.2): The vulnerable code likely uses string concatenation or interpolation to build the SQL query. For example:

$ids = $_GET['selectedIds'];
$query = "SELECT * FROM assets WHERE id IN ($ids)";
$result = $db->query($query);

Patched Code (1.3.2): The fix involves using parameterized queries or prepared statements. For example:

$ids = explode(',', $_GET['selectedIds']);
$placeholders = implode(',', array_fill(0, count($ids), '?'));
$query = "SELECT * FROM assets WHERE id IN ($placeholders)";
$result = $db->executeQuery($query, $ids);

This ensures that user input is treated as data, not executable SQL.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Pimcore instance with Admin Classic Bundle < 1.3.2.
• Valid backend user credentials with basic permissions (e.g., "Data Manager").

Exploitation Steps:

1. Identify the vulnerable endpoint: The zip creation functionality is typically accessed via a URL like /admin/asset/zip?selectedIds=....
2. Craft a malicious payload: Inject SQL into the selectedIds parameter. For example, to extract admin user credentials:

   selectedIds=1 UNION SELECT id, username, password FROM users WHERE admin=1
   

3. Execute the request: Send the crafted request using a tool like curl or Burp Suite.

   curl -k -X GET "https://target/admin/asset/zip?selectedIds=1%20UNION%20SELECT%20id%2C%20username%2C%20password%20FROM%20users%20WHERE%20admin%3D1"
   

4. Escalate privileges: Use the extracted credentials to log in as an admin, or use SQL injection to modify user roles directly:

   selectedIds=1; UPDATE users SET admin=1 WHERE username='attacker'
   

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual SQL queries in database logs, especially those containing UNION, SELECT, or UPDATE statements originating from the web application.
• Look for HTTP requests to /admin/asset/zip with abnormal selectedIds parameters (e.g., containing SQL keywords, special characters, or long strings).

Hunting:

• Search web server logs for requests to /admin/asset/zip with selectedIds containing ', --, UNION, SELECT, UPDATE, INSERT, DELETE, DROP, ALTER, CREATE, EXEC, OR, AND, 1=1, 1=2, etc.
• Correlate these requests with database error messages or unusual database activity.

Prevention:

• Ensure all input validation and parameterized queries are in place.
• Apply the patch by upgrading to version 1.3.2 or later.
• Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /admin/asset/zip with selectedIds containing SQL keywords (e.g., UNION, SELECT, UPDATE, INSERT, DELETE, DROP, ALTER, CREATE, EXEC, OR, AND, 1=1, 1=2, ', --, #, /*, */).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Host:
  • Database logs showing unexpected queries from the web application user.
  • New admin users created in the Pimcore user database.
  • Modified user permissions or roles.
• File:
  • Unusual zip files created containing sensitive data (e.g., database dumps, configuration files).

Detection Engineering

YARA Rule

rule CVE_2024_23646_SQLi_SelectedIds {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-23646 in Pimcore Admin Classic Bundle"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23646"
    strings:
        $s1 = "selectedIds=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "UPDATE" nocase
        $s5 = "INSERT" nocase
        $s6 = "DELETE" nocase
        $s7 = "DROP" nocase
        $s8 = "ALTER" nocase
        $s9 = "CREATE" nocase
        $s10 = "EXEC" nocase
        $s11 = "OR" nocase
        $s12 = "AND" nocase
        $s13 = "1=1" nocase
        $s14 = "1=2" nocase
        $s15 = "'" nocase
        $s16 = "--" nocase
        $s17 = "#" nocase
        $s18 = "/*" nocase
        $s19 = "*/" nocase
    condition:
        $s1 and any of ($s2..$s19)
}

Sigma Rule

title: CVE-2024-23646 SQL Injection in Pimcore Admin Classic Bundle
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the selectedIds parameter in Pimcore Admin Classic Bundle
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23646
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "selectedIds="
    keywords:
        - "UNION"
        - "SELECT"
        - "UPDATE"
        - "INSERT"
        - "DELETE"
        - "DROP"
        - "ALTER"
        - "CREATE"
        - "EXEC"
        - "OR"
        - "AND"
        - "1=1"
        - "1=2"
        - "'"
        - "--"
        - "#"
        - "/*"
        - "*/"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in file names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23646 SQL Injection in Pimcore Admin Classic Bundle"; flow:to_server,established; content:"selectedIds="; http_uri; pcre:"/(UNION|SELECT|UPDATE|INSERT|DELETE|DROP|ALTER|CREATE|EXEC|OR|AND|1=1|1=2|'|--|#|\/\*|\*\/)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the Pimcore Admin Classic Bundle to version 1.3.2 or later.
2. Patch: If immediate upgrade is not possible, apply the vendor-provided patch or manually implement parameterized queries in the affected code.
3. WAF Rules: Deploy or update WAF rules to block SQL injection patterns in the selectedIds parameter.

Long-Term Measures:

• Implement a secure coding policy that mandates the use of parameterized queries for all database interactions.
• Conduct regular security audits and penetration testing.
• Monitor for new CVEs and apply patches promptly.
• Use a Web Application Firewall (WAF) with SQL injection detection capabilities.

Workarounds:

• If upgrading is not possible, restrict access to the zip creation functionality to only trusted admin users.
• Disable the zip creation feature temporarily by removing or commenting out the relevant code.

Valters IT
Securing Digital Frontiers