github - ghsa-xr3m-6gq6-22cg

GHSA-XR3M-6GQ6-22CG

Vulnerability from github – Published: 2025-01-28 19:12 – Updated: 2025-11-04 19:52

Summary

Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document

Details

Summary

A Stored Cross-Site Scripting (XSS) vulnerability in PIMCORE allows remote attackers to inject arbitrary web script or HTML via the PDF upload functionality. This can result in the execution of malicious scripts in the context of the user's browser when the PDF is viewed, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information.

Details

The vulnerability is present in the PDF upload functionality of the PIM Core Upload module. When a user uploads a PDF file, the application fails to properly sanitize the content, allowing embedded scripts to be executed when the PDF is viewed. The affected code is located in the file handling and rendering logic of the PDF upload feature.

PoC

Log in as Administrator
Hover to Assets
Right click and click "Add Asset(s) > upload files
Upload malicious pdf
Click on search and select document
copy the path and open to a new tab

https://demo.pimcore.fun/admin/Sample C

XSS PDF can be access without authentication.

Image showing no cookies indicator that there are no session currently in

Impact

This is a Stored Cross-Site Scripting (XSS) vulnerability. It impacts any user who views the malicious PDF, potentially leading to session hijacking, defacement of web pages, or unauthorized access to sensitive information. The severity is high due to the potential for significant impact on confidentiality and integrity.

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.4.2"
            },
            {
              "fixed": "11.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-11954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-28T19:12:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n \nA Stored Cross-Site Scripting (XSS) vulnerability in PIMCORE allows remote attackers to inject arbitrary web script or HTML via the PDF upload functionality. This can result in the execution of malicious scripts in the context of the user\u0027s browser when the PDF is viewed, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information.\n \n### Details\n \nThe vulnerability is present in the PDF upload functionality of the PIM Core Upload module. When a user uploads a PDF file, the application fails to properly sanitize the content, allowing embedded scripts to be executed when the PDF is viewed. The affected code is located in the file handling and rendering logic of the PDF upload feature.\n \n### PoC\n \n\n \n1. Log in as Administrator\n![image](https://github.com/user-attachments/assets/7945bbd7-5277-4a0e-8365-56e5df319bae)\n\n2. Hover to Assets\n![image](https://github.com/user-attachments/assets/f24645ee-d740-4a5e-81d1-b8bf48b71cce)\n\n \n3. Right click and click \"Add Asset(s) \u003e upload files\n![image](https://github.com/user-attachments/assets/0603cc90-44d8-423e-a01c-b0367fd929bd)\n\n \n4. Upload malicious pdf\n![image](https://github.com/user-attachments/assets/51aa609d-f100-4f46-b3bb-3d730e000a02)\n\n \n5. Click on search and select document\n![image](https://github.com/user-attachments/assets/7e945b26-4f8a-4e91-adea-8f46a0f17856)\n\n \n6. copy the path and open to a new tab \n\n[https://demo.pimcore.fun/admin/Sample C](https://demo.pimcore.fun/Sample%20Content/Documents/xssmaeitsec.pdf)\n \n![image](https://github.com/user-attachments/assets/500d49d6-42f7-4b64-8b01-117f439ace8d)\n\n7. XSS PDF can be access without authentication. \n\n \n![image](https://github.com/user-attachments/assets/7fb53fc2-2f65-42b3-9ed7-fc0413211a3f)\n\n Image showing no cookies indicator that there are no session currently in\n \n![image](https://github.com/user-attachments/assets/89f58fff-0dee-4520-9071-efd024c2f6d3)\n\n### Impact\nThis is a Stored Cross-Site Scripting (XSS) vulnerability. It impacts any user who views the malicious PDF, potentially leading to session hijacking, defacement of web pages, or unauthorized access to sensitive information. The severity is high due to the potential for significant impact on confidentiality and integrity.",
  "id": "GHSA-xr3m-6gq6-22cg",
  "modified": "2025-11-04T19:52:44Z",
  "published": "2025-01-28T19:12:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11954"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.293905"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document"
}

CVE-2024-11954 (GCVE-0-2024-11954)

Vulnerability from cvelistv5 – Published: 2025-01-28 13:14 – Updated: 2025-01-28 14:17

Summary

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Severity ?

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

2.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

2.4 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-80 - Basic Cross Site Scripting
CWE-74 - Injection

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.293905	vdb-entry
	https://vuldb.com/?ctiid.293905	signaturepermissions-required
	https://vuldb.com/?submit.451774	third-party-advisory
	https://github.com/pimcore/pimcore/security/advis…	exploit

Impacted products

	Vendor	Product	Version
	n/a	Pimcore	Affected: 11.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11954",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T14:16:56.639037Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T14:17:00.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/?submit.451774"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Search Document"
          ],
          "product": "Pimcore",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "11.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
        },
        {
          "lang": "de",
          "value": "In Pimcore 11.4.2 wurde eine problematische Schwachstelle entdeckt. Es geht um eine nicht n\u00e4her bekannte Funktion der Komponente Search Document. Durch das Manipulieren mit unbekannten Daten kann eine basic cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "Basic Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-28T13:15:10.797Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-293905 | Pimcore Search Document cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/?id.293905"
        },
        {
          "name": "VDB-293905 | CTI Indicators (IOB, IOC, TTP)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.293905"
        },
        {
          "name": "Submit #451774 | Pimcore 11.4.2 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.451774"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-xr3m-6gq6-22cg"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-01-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-01-28T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-01-28T14:15:14.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Pimcore Search Document cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-11954",
    "datePublished": "2025-01-28T13:14:42.976Z",
    "dateReserved": "2024-11-28T06:53:25.644Z",
    "dateUpdated": "2025-01-28T14:17:00.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-XR3M-6GQ6-22CG

Summary

Details

PoC

Impact

CVE-2024-11954 (GCVE-0-2024-11954)

Tags

Sightings

Nomenclature