CVE-2024-21667: Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
Summary An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure.
Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/gdpr-data/search-data-objects endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place : <https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/GDPRDataController.php#L38>
PoC
In order to reproduce the issue, the following steps can be followed:
1. As an administrator : a. Create a role without any permission through Settings → User & Roles → Roles in the administration panel b. Create an user through Settings → User & Roles → Users and assign it the unprivileged role previously created 2. Log out the current administrator and log in with this new user 3. Access to the following endpoint https://pimcoreinstance/admin/customermanagementframework/gdpr-data/search-data-objects?id=&firstname=&lastname=&email=&page=1&start=0&limit=50 and the results will be returned to this unauthorized user.
Impact An unauthorized user can access PII data from customers without being authorized to.
Other sources
pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not enforced when reaching the /admin/customermanagementframework/gdpr-data/search-data-objects endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. An unauthorized user can access PII data from customers. This vulnerability has been patched in version 4.0.6.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/customer-management-framework-bundleto a version that resolves this vulnerability.Fixed in 4.0.6 - Upgrade
Upgrade
pimcore/customer-data-frameworkto a version that resolves this vulnerability.Fixed in 4.0.6 - Compensating control
Until upgraded, prevent authenticated users without the required permissions from accessing the endpoint `/admin/customermanagementframework/gdpr-data/search-data-objects` (e.g., restrict access via Pimcore role/permission configuration and/or add an external access control such as web server/WAF/ACL rules specific to that path).
- Operational
After patching, revoke/rotate any credentials used by the unauthorized test user and verify that the GDPR data extraction endpoint enforces permissions correctly for all roles/users.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21667?
CVE-2024-21667 has a high severity due to potential unauthorized access to sensitive customer data.
How do I fix CVE-2024-21667?
To fix CVE-2024-21667, ensure that proper permissions are enforced for accessing the GDPR data extraction feature.
Who is affected by CVE-2024-21667?
CVE-2024-21667 affects users of the Pimcore Customer Management Framework version 4.0.6 and earlier.
What is the impact of not addressing CVE-2024-21667?
Not addressing CVE-2024-21667 could lead to customer data exposure and potential breaches of GDPR compliance.
Is there a workaround for CVE-2024-21667?
Currently, there is no documented workaround for CVE-2024-21667; users should update their software to mitigate the risk.