CVE-2024-41109

Executive Summary

CVE-2024-41109 is an information disclosure vulnerability in the Pimcore Admin Classic Bundle, a backend user interface for the Pimcore platform. The vulnerability allows an authenticated user with any level of access to navigate to the /admin/index/statistics endpoint and retrieve sensitive system information. This includes the Pimcore installation version, PHP version, MySQL version, a list of installed bundles, and all database tables along with their row counts. While the CVSS score is 6.3 (Medium), the exposure of detailed system internals can significantly aid an attacker in reconnaissance, potentially leading to more targeted attacks. The vulnerability is fixed in versions 1.3.10, 1.4.6, and 1.5.2 of the Admin Classic Bundle.

Supply Chain & Package Security

This vulnerability affects the Pimcore Admin Classic Bundle, which is a core component of the Pimcore platform. Pimcore is a widely used open-source enterprise content management system (CMS) and product information management (PIM) platform. The vulnerability is introduced through the bundle's code and is not a dependency issue. However, the exposure of installed bundles and database schema information could reveal the presence of other third-party plugins or custom modules, potentially expanding the attack surface. Organizations using Pimcore should ensure they are running a patched version of the Admin Classic Bundle and review their dependency tree for any other vulnerable components.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low (L) - An attacker needs a valid, low-privileged user account to exploit this.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond its security scope.
• Confidentiality Impact (C): Low (L) - Limited information disclosure, but includes sensitive system details.
• Integrity Impact (I): Low (L) - The vulnerability itself does not allow data modification, but disclosed info could be used to plan integrity attacks.
• Availability Impact (A): Low (L) - The vulnerability itself does not affect availability, but disclosed info could be used to plan availability attacks.

Threat Level: Medium. The vulnerability requires authentication, but the low privileges needed and the wealth of information disclosed make it a valuable reconnaissance tool for attackers. The EPSS score of 0.0% suggests low active exploitation in the wild, but this does not diminish the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the AdminController of the Pimcore Admin Classic Bundle. The /admin/index/statistics endpoint is intended for internal use, likely for displaying system statistics in the admin dashboard. However, it lacks proper authorization checks beyond basic authentication. When a logged-in user accesses this endpoint, the controller executes a series of queries and system calls to gather information:

1. Pimcore Version: Retrieved from the PIMCORE_VERSION constant or a configuration file.
2. PHP Version: Retrieved using phpversion().
3. MySQL Version: Retrieved by querying the database with SELECT VERSION().
4. Installed Bundles: Retrieved by iterating over the kernel's bundle collection.
5. Database Tables and Row Counts: Retrieved by querying information_schema.tables for all tables in the current database, and then running SELECT COUNT(*) on each table.

The response is typically a JSON object containing all this data. The vulnerability is that this endpoint should be restricted to administrators only, but it is accessible to any authenticated user, including those with limited roles like "Data Entry" or "Editor".

Vulnerable vs. Patched Code

Vulnerable Code (Pre-Fix): The vulnerable code in the AdminController likely looks similar to this (simplified for illustration):

// Vulnerable: No role/permission check
public function statisticsAction(Request $request): JsonResponse
{
    $data = [
        'pimcore_version' => Pimcore::getVersion(),
        'php_version' => phpversion(),
        'mysql_version' => Db::get()->fetchOne('SELECT VERSION()'),
        'bundles' => $this->getParameter('kernel.bundles'),
        'tables' => $this->getTableRowCounts(),
    ];

    return new JsonResponse($data);
}

private function getTableRowCounts(): array
{
    $tables = Db::get()->fetchAll("SELECT TABLE_NAME FROM information_schema.tables WHERE TABLE_SCHEMA = ?", [Db::get()->getDatabase()]);
    $counts = [];
    foreach ($tables as $table) {
        $counts[$table['TABLE_NAME']] = Db::get()->fetchOne("SELECT COUNT(*) FROM " . $table['TABLE_NAME']);
    }
    return $counts;
}

Patched Code (Post-Fix): The patched code adds an authorization check to ensure only users with the appropriate permission (e.g., admin) can access the endpoint.

// Patched: Added permission check
public function statisticsAction(Request $request): JsonResponse
{
    // Check if user has admin permission
    if (!$this->getUser()->isAllowed('admin')) {
        throw new AccessDeniedHttpException('Access denied.');
    }

    $data = [
        'pimcore_version' => Pimcore::getVersion(),
        'php_version' => phpversion(),
        'mysql_version' => Db::get()->fetchOne('SELECT VERSION()'),
        'bundles' => $this->getParameter('kernel.bundles'),
        'tables' => $this->getTableRowCounts(),
    ];

    return new JsonResponse($data);
}

The key difference is the addition of $this->getUser()->isAllowed('admin') which verifies the user has the admin permission before returning the sensitive data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on a Pimcore instance running a vulnerable version of the Admin Classic Bundle (< 1.3.10, < 1.4.6, < 1.5.2).
• Network access to the Pimcore instance.

Exploitation Steps:

1. Authenticate: Log in to the Pimcore admin interface with the low-privileged user credentials.
2. Access the Endpoint: Navigate to the following URL in your browser or via a tool like curl:

   http://target-pimcore.com/admin/index/statistics
   

3. Retrieve Data: The server will respond with a JSON object containing the sensitive information. Example response:

   {
       "pimcore_version": "11.1.0",
       "php_version": "8.1.22",
       "mysql_version": "8.0.34",
       "bundles": {
           "PimcoreAdminBundle": {"path": "...", "class": "..."},
           "PimcoreEcommerceFrameworkBundle": {"path": "...", "class": "..."},
           "CustomPluginBundle": {"path": "...", "class": "..."}
       },
       "tables": {
           "assets": 1234,
           "documents": 567,
           "objects": 890,
           "users": 45,
           "custom_data": 10000
       }
   }
   

4. Analyze: Use this information to:
   • Identify outdated PHP/MySQL versions for potential exploitation.
   • Discover installed bundles (e.g., e-commerce framework) for targeted attacks.
   • Understand database schema and table sizes to plan data extraction or injection attacks.

Automated Exploitation (using curl):

curl -c cookies.txt -b cookies.txt -X GET "http://target-pimcore.com/admin/index/statistics" -H "Accept: application/json"

Blue Team

Detection:

• Monitor access logs for requests to /admin/index/statistics from non-admin users.
• Alert on any access to this endpoint from IP addresses not associated with known administrators.
• Look for patterns of reconnaissance, such as multiple requests to /admin/index/statistics followed by attempts to access other sensitive endpoints.

Hunting:

• Search web server logs for the exact URI pattern /admin/index/statistics.
• Correlate these requests with user sessions that have low privilege roles (e.g., ROLE_USER, ROLE_EDITOR).
• Check for unusual database queries that might indicate an attacker is using the disclosed table names.

Prevention:

• Immediately apply the patch by upgrading the Admin Classic Bundle to version 1.3.10, 1.4.6, or 1.5.2.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block access to /admin/index/statistics for all users except those in the admin role.
• Restrict network access to the Pimcore admin interface to trusted IP ranges only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /admin/index/statistics from non-admin user sessions.
  • JSON responses containing fields like pimcore_version, php_version, mysql_version, bundles, and tables.
• File IOCs:
  • Unusual entries in web server access logs showing the /admin/index/statistics URI.
• System IOCs:
  • Database queries against information_schema.tables originating from the Pimcore application user.
  • PHP function calls to phpversion() triggered by non-admin users.

Detection Engineering

YARA Rule

rule Detect_Pimcore_Info_Disclosure_Request {
    meta:
        description = "Detects HTTP requests to the vulnerable Pimcore statistics endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-41109"
        severity = "medium"
    strings:
        $uri = "/admin/index/statistics"
        $json_field = "pimcore_version"
    condition:
        $uri or $json_field
}

Sigma Rule

title: Pimcore Admin Statistics Endpoint Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to the vulnerable /admin/index/statistics endpoint in Pimcore
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41109
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem: "/admin/index/statistics"
    condition: selection
falsepositives:
    - Legitimate admin users accessing the statistics page
level: medium
tags:
    - attack.reconnaissance
    - cve.2024.41109

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41109 Pimcore Admin Statistics Information Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"/admin/index/statistics"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade the Pimcore Admin Classic Bundle to version 1.3.10, 1.4.6, or 1.5.2. This is the definitive fix.
2. WAF Rule: If patching is delayed, create a WAF rule to block access to /admin/index/statistics for any user without the admin role. Example for ModSecurity:

   SecRule REQUEST_URI "/admin/index/statistics" "id:1001,phase:1,t:lowercase,deny,msg:'Pimcore Info Disclosure Attempt'"
   

3. Access Control: Review and tighten user roles and permissions. Ensure that only administrators have access to sensitive administrative functions.

Long-Term Measures:

1. Security Audits: Regularly audit custom code and third-party bundles for similar authorization flaws.
2. Principle of Least Privilege: Implement strict role-based access control (RBAC) across the entire Pimcore application.
3. Monitoring: Set up alerts for access to sensitive endpoints and unusual database queries.
4. Update Policy: Establish a policy for timely application of security patches, especially for core components like the Admin Classic Bundle.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.