CVE-2023-47636

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. In the case of pimcore, the fopen() function here doesnt have an error handle when the file doesnt exist on the server so the server response raises the full path fopen(/var/www/html/var/tmp/export-{ uniqe id}.csv). This issue has been patched in commit 10d178ef771 which has been included in release version 1.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Affected Software

Potential Mitigations

• Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
• If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
• Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/215.html
• https://cwe.mitre.org/data/definitions/463.html
• https://cwe.mitre.org/data/definitions/54.html
• https://cwe.mitre.org/data/definitions/7.html

References

• https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-c8hj-w239-5gvf
• https://huntr.com/bounties/4af4db18-9fd4-43e9-8bc6-c88aaf76839c/
• https://github.com/pimcore/admin-ui-classic-bundle/commit/10d178ef771097604a256c1192b098af9ec57a87
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-c8hj-w239-5gvf
• https://huntr.com/bounties/4af4db18-9fd4-43e9-8bc6-c88aaf76839c/