Pimcore Multiple Vulnerabilities

A researcher at Tenable discovered multiple access control vulnerabilities in Pimcore bundles.

Pimcore E-Commerce Framework Bundle

CVE-2024-21665 - Improper Access Control allows unprivileged user to access back-office orders list (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

An authenticated and unauthorized user can access the back-office orders list and is able to query over the information returned without having the privileges.

Proof Of Concept:

In order to reproduce the issue, the following steps can be followed on a Pimcore instance using this feature / bundle:

• As an administrator :
  • Create a role without any permission through Settings -> User & Roles -> Roles in the administration panel
  • Create an user through Settings -> User & Roles -> Users and assign it the unprivileged role previously created.
• Log out the current administrator and log in with the new user.
• Access to the following endpoint https://pimcore_instance/admin/ecommerceframework/admin-order/list and the results will be returned to this unauthorized user.

Pimcore Customer Data Framework Bundle

CVE-2024-21666 - Improper Access Control allows unprivileged user to access customers duplicates list (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

An authenticated and unauthorized user can access the list of potential duplicate users and see their data.

Proof Of Concept:

In order to reproduce the issue, the following steps can be followed on a Pimcore instance using this feature / bundle:

• As an administrator :
  • Create a role without any permission through Settings -> User & Roles -> Roles in the administration panel
  • Create an user through Settings -> User & Roles -> Users and assign it the unprivileged role previously created.
• Log out the current administrator and log in with the new user.
• Access to the following endpoint https://pimcore_instance/admin/customermanagementframework/duplicates/list and the results will be returned to this unauthorized user.

CVE-2024-21667 - Improper Access Control allows unprivileged user to access GDPR extracts (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure.

Proof Of Concept:

In order to reproduce the issue, the following steps can be followed on a Pimcore instance using this feature / bundle:

• As an administrator :
  • Create a role without any permission through Settings -> User & Roles -> Roles in the administration panel
  • Create an user through Settings -> User & Roles -> Users and assign it the unprivileged role previously created.
• Log out the current administrator and log in with the new user.
• Access to the following endpoint https://pimcore_instance/admin/customermanagementframework/gdpr-data/search-data-objects and the results will be returned to this unauthorized user.