github - GHSA-xr3m-6gq6-22cg

GHSA-xr3m-6gq6-22cg

Vulnerability from github

Published

2025-01-28 19:12

Modified

2025-11-04 19:52

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Summary

Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document

Details

Summary

A Stored Cross-Site Scripting (XSS) vulnerability in PIMCORE allows remote attackers to inject arbitrary web script or HTML via the PDF upload functionality. This can result in the execution of malicious scripts in the context of the user's browser when the PDF is viewed, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information.

Details

The vulnerability is present in the PDF upload functionality of the PIM Core Upload module. When a user uploads a PDF file, the application fails to properly sanitize the content, allowing embedded scripts to be executed when the PDF is viewed. The affected code is located in the file handling and rendering logic of the PDF upload feature.

PoC

Log in as Administrator
Hover to Assets
Right click and click "Add Asset(s) > upload files
Upload malicious pdf
Click on search and select document
copy the path and open to a new tab

https://demo.pimcore.fun/admin/Sample C

XSS PDF can be access without authentication.

Image showing no cookies indicator that there are no session currently in

Impact

This is a Stored Cross-Site Scripting (XSS) vulnerability. It impacts any user who views the malicious PDF, potentially leading to session hijacking, defacement of web pages, or unauthorized access to sensitive information. The severity is high due to the potential for significant impact on confidentiality and integrity.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.4.2"
            },
            {
              "fixed": "11.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-11954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-28T19:12:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n \nA Stored Cross-Site Scripting (XSS) vulnerability in PIMCORE allows remote attackers to inject arbitrary web script or HTML via the PDF upload functionality. This can result in the execution of malicious scripts in the context of the user\u0027s browser when the PDF is viewed, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information.\n \n### Details\n \nThe vulnerability is present in the PDF upload functionality of the PIM Core Upload module. When a user uploads a PDF file, the application fails to properly sanitize the content, allowing embedded scripts to be executed when the PDF is viewed. The affected code is located in the file handling and rendering logic of the PDF upload feature.\n \n### PoC\n \n\n \n1. Log in as Administrator\n![image](https://github.com/user-attachments/assets/7945bbd7-5277-4a0e-8365-56e5df319bae)\n\n2. Hover to Assets\n![image](https://github.com/user-attachments/assets/f24645ee-d740-4a5e-81d1-b8bf48b71cce)\n\n \n3. Right click and click \"Add Asset(s) \u003e upload files\n![image](https://github.com/user-attachments/assets/0603cc90-44d8-423e-a01c-b0367fd929bd)\n\n \n4. Upload malicious pdf\n![image](https://github.com/user-attachments/assets/51aa609d-f100-4f46-b3bb-3d730e000a02)\n\n \n5. Click on search and select document\n![image](https://github.com/user-attachments/assets/7e945b26-4f8a-4e91-adea-8f46a0f17856)\n\n \n6. copy the path and open to a new tab \n\n[https://demo.pimcore.fun/admin/Sample C](https://demo.pimcore.fun/Sample%20Content/Documents/xssmaeitsec.pdf)\n \n![image](https://github.com/user-attachments/assets/500d49d6-42f7-4b64-8b01-117f439ace8d)\n\n7. XSS PDF can be access without authentication. \n\n \n![image](https://github.com/user-attachments/assets/7fb53fc2-2f65-42b3-9ed7-fc0413211a3f)\n\n Image showing no cookies indicator that there are no session currently in\n \n![image](https://github.com/user-attachments/assets/89f58fff-0dee-4520-9071-efd024c2f6d3)\n\n### Impact\nThis is a Stored Cross-Site Scripting (XSS) vulnerability. It impacts any user who views the malicious PDF, potentially leading to session hijacking, defacement of web pages, or unauthorized access to sensitive information. The severity is high due to the potential for significant impact on confidentiality and integrity.",
  "id": "GHSA-xr3m-6gq6-22cg",
  "modified": "2025-11-04T19:52:44Z",
  "published": "2025-01-28T19:12:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11954"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.293905"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document"
}

CVE-2024-11954 (GCVE-0-2024-11954)

Vulnerability from cvelistv5

Published

2025-01-28 13:14

Modified

2025-01-28 14:17

Severity ?

5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
2.4 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
2.4 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-80 - Basic Cross Site Scripting
CWE-74 - Injection

Summary

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

References

URL

Tags

	https://vuldb.com/?id.293905	vdb-entry
	https://vuldb.com/?ctiid.293905	signature, permissions-required
	https://vuldb.com/?submit.451774	third-party-advisory
	https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg	exploit

Impacted products

	Vendor	Product	Version
	n/a	Pimcore	Version: 11.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11954",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T14:16:56.639037Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T14:17:00.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/?submit.451774"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Search Document"
          ],
          "product": "Pimcore",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "11.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
        },
        {
          "lang": "de",
          "value": "In Pimcore 11.4.2 wurde eine problematische Schwachstelle entdeckt. Es geht um eine nicht n\u00e4her bekannte Funktion der Komponente Search Document. Durch das Manipulieren mit unbekannten Daten kann eine basic cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "Basic Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-28T13:15:10.797Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-293905 | Pimcore Search Document cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/?id.293905"
        },
        {
          "name": "VDB-293905 | CTI Indicators (IOB, IOC, TTP)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.293905"
        },
        {
          "name": "Submit #451774 | Pimcore 11.4.2 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.451774"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-01-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-01-28T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-01-28T14:15:14.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Pimcore Search Document cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-11954",
    "datePublished": "2025-01-28T13:14:42.976Z",
    "dateReserved": "2024-11-28T06:53:25.644Z",
    "dateUpdated": "2025-01-28T14:17:00.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

GHSA-xr3m-6gq6-22cg

Vulnerability from github

Summary

Details

PoC

Impact

CVE-2024-11954 (GCVE-0-2024-11954)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature