Listen to this Post
The vulnerability exists in the API endpoint (e.g., GET /api/static-routes) responsible for listing static route configurations. Static routes in Pimcore are custom URL patterns defined via the backend or var/config/staticroutes.php. While the endpoint correctly verifies user authentication via session cookies and CSRF tokens, it fails to perform a subsequent server-side authorization check. The PimcoreStaticRoutesBundle registers these routes without enforcing function-level permissions. Consequently, any authenticated backend user, regardless of their specific role permissions for the “Static Routes” feature, can successfully send a valid request to this endpoint. The application processes the request and returns the full list of static routes, including their regex patterns, controllers, and variables, as it mistakenly assumes the frontend interface controls access. This missing check allows unauthorized access to sensitive routing metadata, violating proper access control principles.
Platform: Pimcore
Version: Multiple versions
Vulnerability: Broken Access Control
Severity: Medium
date: To be disclosed
Prediction: 2024-10-15
What Undercode Say:
Simulating the unauthorized API call curl -X GET 'https://target.com/api/static-routes' \ -H 'Cookie: pimcore_admin_sid=...' \ -H 'X-Pimcore-Csrf-Token: ...'
// Example of a missing authorization check in controller
public function listAction(Request $request): JsonResponse
{
// Authenticates but does not authorize
$this->checkCsrfToken($request);
$routes = $this->staticRouteLoader->loadRoutes();
return new JsonResponse($routes); // Vulnerability here
}
How Exploit:
1. Attacker logs in as low-privilege backend user.
- Attacker captures valid CSRF token and session cookie.
3. Attacker sends GET request to `/api/static-routes`.
4. Application returns all static route configurations.
Protection from this CVE:
1. Implement server-side authorization.
2. Check user permissions.
3. Update to patched version.
Impact:
Information disclosure.
Attack surface expansion.
Possible chain attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
