Listen to this Post
The vulnerability CVE-2024-21790 in Pimcore stems from missing function-level access control within the application’s backend. The API endpoints for managing “Favourite Output Channel Configurations” only verify that a user is authenticated but do not perform subsequent checks for specific object-level or feature permissions. The authorization logic relies solely on the presence of a valid session and CSRF token, which are both obtained during a standard login. When a low-privileged user sends a crafted HTTP request (POST or GET) to these endpoints—such as /admin/object/favourite/output-channel/configurations—using a stolen CSRF token and session cookie from an admin, the server processes the request as valid. It incorrectly assumes the session owner has the requisite rights because the permission validation for the `favourite_output_channel_configurations` action is absent or bypassed at the controller layer, allowing unauthorized data manipulation.
Platform: Pimcore
Version: < 11.2.1
Vulnerability: Broken Access Control
Severity: Critical
date: 2024-03-05
Prediction: 2024-03-19
What Undercode Say:
curl -X GET 'https://target/admin/object/favourite/output-channel/configurations' -H 'X-Pimcore-Csrf-Token: STOLEN_TOKEN' --cookie 'pimcore_admin_sid=STOLEN_SESSION'
Check endpoint accessibility grep -r "favourite.output.channel.configurations" ./vendor/pimcore/
// Sample vulnerable controller logic (conceptual)
public function updateConfigAction(Request $request) {
// Missing check like: $this->checkPermission('favourite_output_channel_configurations');
$config = $this->decodeRequest($request); // Processes request if CSRF valid.
$this->saveConfig($config); // Unauthorized save executed.
}
How Exploit:
- Admin logs in, browses feature, intercepts requests with proxy.
2. Attacker obtains valid low-privileged backend user session.
- Attacker replaces request’s `Cookie` and `X-Pimcore-Csrf-Token` headers with stolen admin tokens.
- Attacker sends forged POST/GET requests to list, create, or update configurations.
- Server processes requests due to missing permission check, leading to privilege escalation.
Protection from this CVE:
Apply patch Pimcore 11.2.1.
Implement strict function-level authorization.
Validate user permissions per endpoint.
Use role-based access control (RBAC).
Impact:
Unauthorized configuration modification.
Privilege escalation.
Data integrity loss.
Operational disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
