CVE-2024-29197

Executive Summary

CVE-2024-29197 is a missing authorization vulnerability in Pimcore, an open-source Data & Experience Management Platform. The flaw allows any unauthenticated user to view unpublished (draft/preview) content by simply appending the query parameter ?pimcore_preview=true to a URL. In previous versions, session information was propagated to previews, restricting access to logged-in users. This protection has been removed, leaving previews broadly accessible. The vulnerability has a CVSS score of 6.5 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, the impact is significant for organizations using Pimcore to manage confidential or unreleased content, as an attacker could gain unauthorized access to sensitive information.

Supply Chain & Package Security

Pimcore is a PHP-based application distributed via Composer (Packagist). The vulnerability affects the core application logic. Organizations should verify their Pimcore version and update to the patched releases (11.2.2 or 11.1.6.1) immediately. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit (no authentication required) and could lead to disclosure of unpublished content. However, the EPSS score of 0.0% suggests low active exploitation.

Deep Dive & Mechanics

The vulnerability resides in Pimcore's preview functionality. When a user requests a page with the ?pimcore_preview=true parameter, the application renders the unpublished version of that page. In earlier versions, the preview was protected by session authentication, meaning only a logged-in user could access it. This protection was inadvertently removed in a code change, likely during a refactoring of the preview middleware or controller.

The core issue is a missing authorization check (CWE-862). The application fails to verify that the requesting user has the necessary permissions to view unpublished content. The parameter pimcore_preview=true acts as a simple toggle, and without proper validation, any request triggers the preview rendering.

Attack Scenario:

1. An attacker identifies a Pimcore instance (e.g., via Shodan or Google dorking).
2. The attacker appends ?pimcore_preview=true to any known or guessed URL (e.g., /about, /products/new).
3. The server returns the unpublished version of that page, potentially containing confidential information such as upcoming product details, internal notes, or unreleased content.

Vulnerable vs. Patched Code

Vulnerable Code (Pimcore < 11.2.2 / < 11.1.6.1):

// In the controller or middleware handling preview requests
if ($request->get('pimcore_preview') === 'true') {
    // No session check - renders unpublished content directly
    $document = Document::getById($id, true); // true = unpublished
    return $this->renderDocument($document);
}

Patched Code (Pimcore >= 11.2.2 / >= 11.1.6.1):

// In the controller or middleware handling preview requests
if ($request->get('pimcore_preview') === 'true') {
    // Added authorization check
    $user = $this->getUser();
    if (!$user || !$user->isAllowed('documents', 'preview')) {
        throw new AccessDeniedException('Preview not allowed');
    }
    $document = Document::getById($id, true); // true = unpublished
    return $this->renderDocument($document);
}

The patch adds a check for user authentication and permission (isAllowed('documents', 'preview')). This ensures only authorized users can access previews.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Pimcore instance running a vulnerable version (< 11.2.2 or < 11.1.6.1).
• Knowledge of a valid page URL on the target instance.

Exploitation Steps:

1. Identify the target Pimcore instance (e.g., https://target.com).
2. Choose a page URL, such as /about or /products.
3. Append the query parameter: https://target.com/about?pimcore_preview=true
4. Observe the response. If the page contains unpublished content (e.g., draft text, hidden images), the exploitation is successful.

Example cURL command:

curl -v "https://target.com/about?pimcore_preview=true"

Automated Scanning (using Nuclei):

id: pimcore-preview-bypass

info:
  name: Pimcore Preview Bypass
  author: Valters IT
  severity: medium
  description: Detects CVE-2024-29197 - Unauthenticated preview access in Pimcore.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29197
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 6.5
    cwe-id: CWE-862

requests:
  - method: GET
    path:
      - "{{BaseURL}}/?pimcore_preview=true"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "pimcore"
          - "preview"
        condition: or
      - type: status
        status:
          - 200

Blue Team

Detection Steps:

1. Monitor web server logs for requests containing pimcore_preview=true.
2. Alert on any such requests from IP addresses not associated with authenticated users.
3. Review access logs for unusual patterns, such as repeated preview requests to multiple pages.

Honeypot:

• Create a fake unpublished page with a unique string (e.g., "HONEYPOT-UNPUBLISHED-CONTENT").
• Monitor for requests to that page with ?pimcore_preview=true.
• If detected, investigate the source IP immediately.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests containing ?pimcore_preview=true in the query string.
  • User-Agent strings typical of automated scanners (e.g., curl, python-requests, Nuclei).

• File IOCs:

  • Access logs showing pimcore_preview=true parameter.
  • Error logs indicating AccessDeniedException after patching (if attempted exploitation).

• Behavioral IOCs:

  • Unusual access to pages that are known to be in draft status.
  • Multiple requests to different pages with the same preview parameter from a single IP.

Detection Engineering

YARA Rule

rule CVE_2024_29197_Pimcore_Preview_Bypass {
    meta:
        description = "Detects requests exploiting CVE-2024-29197 in Pimcore"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
    strings:
        $preview_param = "pimcore_preview=true"
    condition:
        $preview_param
}

Sigma Rule

title: Pimcore Preview Bypass Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with pimcore_preview=true parameter indicating CVE-2024-29197 exploitation attempt.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "pimcore_preview=true"
    condition: selection
falsepositives:
    - Legitimate preview requests from authorized users (should be rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29197 Pimcore Preview Bypass Attempt"; flow:to_server; content:"pimcore_preview=true"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Pimcore to version 11.2.2 or 11.1.6.1 (or later).
2. If immediate update is not possible, implement a Web Application Firewall (WAF) rule to block requests containing pimcore_preview=true from unauthenticated users.
3. Review access logs for any signs of exploitation.

Long-term Mitigations:

• Implement additional authentication checks for all preview functionality.
• Conduct a security audit of the Pimcore instance to identify other potential authorization gaps.
• Enable logging and monitoring for all preview-related requests.

WAF Rule Example (ModSecurity):

SecRule ARGS_GET:pimcore_preview "@eq true" "id:1000002,phase:1,deny,status:403,msg:'Pimcore Preview Bypass Attempt'"

Valters IT