Listen to this Post
The vulnerability occurs in the `ResponseExceptionListener.php` component. When an HTTP error occurs in the Pimcore default context, the `logToHttpErrorLog` method is triggered. This method serializes and stores the `$_SERVER` and `$_COOKIE` superglobal arrays directly into the `http_error_log` database table without sanitization. Consequently, sensitive environment variables (like database credentials from `$_ENV` passed through $_SERVER) and session cookie data are written to this log. Any backend user with access to the “HTTP Errors” section under “Search Engine Optimization” can view these log entries. By double-clicking an entry, the detailed view exposes the raw serialized sensitive data, allowing for information recovery. The core issue is the unnecessary logging of these complete superglobal arrays in a production error log accessible via the admin interface.
Platform: Pimcore
Version: >=12.0.0-RC1,<=12.3 / <=11.5.13
Vulnerability : Information Disclosure
Severity: High
date: 2026-01-15
Prediction: 2026-01-15
What Undercode Say:
Analytics:
Check if your version is affected composer show pimcore/pimcore | grep version Grep for the vulnerable logging pattern in the source code grep -r "serialize.\$_SERVER" bundles/SeoBundle/ grep -r "serialize.\$_COOKIE" bundles/SeoBundle/
// Vulnerable code from lines ~92-93 (conceptual)
$this->db->insert('http_error_log', [
// ... other fields ...
'parametersServer' => serialize($_SERVER), // Exposes ENV variables
'parametersCookies' => serialize($_COOKIE), // Exposes session data
]);
How Exploit:
1. Attacker triggers a backend error.
2. Accesses SEO > HTTP Errors in backend.
3. Views log entry details.
4. Extracts serialized `$_SERVER`/`$_COOKIE` data.
5. Deserializes to recover credentials/sessions.
Protection from this CVE
Immediately upgrade to patched versions: 12.3.1 or 11.5.14.
Manually remove or comment out the two offending `serialize($_SERVER)` and `serialize($_COOKIE)` lines in ResponseExceptionListener.php.
Review and rotate any database credentials or secrets potentially exposed in logs.
Restrict backend access to trusted users only.
Impact:
Backend users can access sensitive `$_SERVER` and `$_COOKIE` data, leading to exposure of database passwords, environment configurations, and session information, potentially enabling full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
