CVE-2023-37280: Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
Summary
Unauthenticated HTML Injection / XSS Possible. Conditions: 2factor authentication must not set before
Vulnerable Endpoint: /admin/login/2fa-setup
Vulnerable Param: error= How it works, So basically any admin, who has not setup 2 factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts / HTML Contents.
Another potential attack vector, as it's a 2fa page and it has QR Code, attacker can replace this QR Code with something he has, leading to increase threat to the admin.
This attack can be used to execute arbitrary scripts or HTML Injection, causing the target application to execute these resulting in cookie steeling, defacement or Injecting phishing URLs on the target application.
Patches Update to version 1.0.3 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch
Workarounds Apply patches manually: https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch
References https://huntr.dev/bounties/1fa1cc3b-75ff-4d34-99ae-4a705eb623e7/
Other sources
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/admin-ui-classic-bundleto a version that resolves this vulnerability.Fixed in 1.0.3 - Upgrade
Upgrade
Pimcore admin UI classic bundleto a version that resolves this vulnerability.Fixed in 1.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch - Configuration
Mitigate per provided condition: ensure 2FA is set up before an admin uses the /admin/login/2fa-setup page, since admins who have not set up two factor authentication before are vulnerable.
Pimcore 2factor authentication setup must be set before = required - Compensating control
If possible, restrict access to the vulnerable endpoint /admin/login/2fa-setup to trusted users/admins only, to reduce exposure to unauthenticated HTML injection/XSS on the error= parameter.
Event History
Frequently Asked Questions
What is CVE-2023-37280?
CVE-2023-37280 is a vulnerability in Pimcore Admin Classic Bundle that allows unauthenticated HTML injection/XSS.
What is the severity of CVE-2023-37280?
The severity of CVE-2023-37280 is medium with a CVSS score of 6.1.
Which software versions are affected by CVE-2023-37280?
Versions up to and excluding 1.0.3 of Pimcore Admin Classic Bundle are affected.
How can I fix CVE-2023-37280?
To fix CVE-2023-37280, update Pimcore Admin Classic Bundle to version 1.0.3 or higher.
Where can I find more information about CVE-2023-37280?
You can find more information about CVE-2023-37280 in the following references: [link1], [link2], [link3].