Listen to this Post
The vulnerability exists in the `/admin/properties/predefined-properties/list` API endpoint. The endpoint fails to perform proper server-side authorization checks, relying solely on the presence of a valid session cookie and CSRF token. When an authenticated backend user sends a GET request to this endpoint, the application does not verify if the user’s role has the explicit “property management” permissions. It incorrectly assumes that access to the admin interface and a valid CSRF token are sufficient for authorization. This allows a low-privileged user to reuse a captured CSRF token and their own session cookie (or a hijacked admin cookie) to successfully enumerate all Predefined Properties. The flaw is a classic Missing Function Level Access Control (Broken Access Control), where the enforcement mechanism checks for authentication but not for specific application-level privileges.
dailycve form:
Platform: Pimcore
Version: All prior
Vulnerability: Broken Access Control
Severity: Medium
date: Pending
Prediction: 2024-12-15
What Undercode Say:
Analytics:
curl -X GET 'https://target.com/admin/properties/predefined-properties/list' \ -H 'Cookie: pimcore_admin_sid=...' \ -H 'X-Pimcore-Csrf-Token: ...'
grep -r "predefined-properties/list" /var/www/pimcore/
How Exploit:
1. Authenticate as low-privilege user.
2. Obtain valid CSRF token.
3. Request property list endpoint.
4. Parse exposed configuration data.
Protection from this CVE:
1. Implement server-side authorization.
2. Apply permission checks.
3. Patch to latest version.
Impact:
Sensitive metadata exposure.
Business logic reconnaissance.
Compliance violations possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
