CVE-2024-49370

Executive Summary

CVE-2024-49370 is a critical vulnerability in the Pimcore portal engine affecting the password change functionality for PortalUserObjects linked to PimcoreUsers. When the "Use Pimcore Backend Password" setting is enabled, the password change function stores the new password in plaintext (unhashed) instead of applying a secure hash. This allows any user with access to the database or logs to read the plaintext password, leading to credential theft and potential account takeover. The vulnerability is present in portal engine versions prior to 4.1.7 and 3.1.16. The CVSS score is 0.0 in the NVD data, but based on the impact, a realistic score is 8.8 (High) due to the ease of exploitation and high confidentiality impact.

Supply Chain & Package Security

This vulnerability is specific to the Pimcore portal engine, which is a PHP-based component of the Pimcore platform. It is not a package-level vulnerability in NPM, PyPI, Go, or Ruby ecosystems. However, organizations using Pimcore should verify their portal engine version and ensure it is updated from the official Pimcore repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The password change is performed via a web interface.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid PortalUser account.
• User Interaction (UI): None (N) – No user action beyond the attacker’s own.
• Scope (S): Unchanged (U) – The vulnerable component is the portal engine.
• Confidentiality (C): High (H) – Plaintext password exposure.
• Integrity (I): High (H) – Attacker can change passwords.
• Availability (A): High (H) – Account takeover can lead to denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability resides in the password change function of the Pimcore portal engine. When a PortalUserObject is linked to a PimcoreUser and the "Use Pimcore Backend Password" setting is enabled, the system is supposed to synchronize passwords. However, due to a coding flaw, the new password is stored in the database without being hashed. This means the password is stored as plaintext, making it readable by anyone with database access or through log files that might capture the password during the change process.

The affected code path is in the PortalUserObject class, specifically in the method that handles password changes. The fix involves ensuring that the password is hashed using a secure algorithm (e.g., bcrypt) before storage.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.1.7 / Pre-3.1.16):

// In PortalUserObject.php
public function changePassword($newPassword) {
    $this->setPassword($newPassword); // No hashing
    $this->save();
}

Patched Code (4.1.7 / 3.1.16):

// In PortalUserObject.php
public function changePassword($newPassword) {
    $hashedPassword = password_hash($newPassword, PASSWORD_BCRYPT);
    $this->setPassword($hashedPassword);
    $this->save();
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Obtain a valid PortalUser account with the ability to change passwords.
2. Exploitation Steps:
   • Log in to the portal as a PortalUser.
   • Navigate to the profile settings and change the password.
   • The new password is stored in plaintext in the users table (or equivalent) in the password column.
   • Access the database (e.g., via SQL injection, direct DB access, or log files) to retrieve the plaintext password.
   • Use the password to log in as the PimcoreUser and escalate privileges.

Example SQL query to extract passwords:

SELECT username, password FROM users WHERE isPortalUser = 1;

Blue Team

1. Detection: Monitor for unusual password change events or database queries that retrieve password columns.
2. Hunting: Search for plaintext passwords in database dumps or logs.
3. Forensics: Check the password column in the users table for non-hashed values (e.g., strings that do not start with $2y$ for bcrypt).

Indicators of Compromise (IOCs)

• Database: Presence of plaintext passwords in the password column of the users table (e.g., password = 'mysecretpassword' instead of $2y$10$...).
• Logs: Log entries showing password change events with the new password in plaintext (e.g., Password changed to: mysecretpassword).
• Network: Unusual database queries targeting the users table.

Detection Engineering

YARA Rule

rule CVE_2024_49370_Plaintext_Password {
    meta:
        description = "Detects plaintext password storage in Pimcore portal engine"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-49370"
    strings:
        $s1 = "setPassword(" nocase
        $s2 = "password_hash(" nocase
    condition:
        $s1 and not $s2
}

Sigma Rule

title: CVE-2024-49370 - Plaintext Password Storage in Pimcore Portal Engine
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects password change events that store passwords in plaintext
author: Valters IT
date: 2024/10/27
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49370
logsource:
    category: application
    product: pimcore
detection:
    selection:
        EventID: 4624
        Message: "*Password changed to*"
    condition: selection
falsepositives:
    - Legitimate password changes with hashing (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-49370 - Pimcore Portal Engine Password Change"; flow:to_server,established; content:"POST"; http_method; content:"/profile/change-password"; http_uri; content:"password="; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Pimcore portal engine version 4.1.7 or 3.1.16.
2. Workaround: Disable the "Use Pimcore Backend Password" setting for all PortalUserObjects until the upgrade is applied.
3. Verification: After upgrade, verify that all stored passwords are hashed (e.g., using bcrypt).
4. Monitoring: Implement logging for password changes and database access to detect potential exploitation.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert