Pimcore admin-ui-classic-bundle is a Backend UI extension that is widely used by many developers to provide a user-friendly interface for managing Pimcore applications. Recently, a security vulnerability (CVE-2023-42817) has been discovered that could allow attackers to exploit permissions and potentially gain unauthorized access to the application by manipulating translation strings containing the %s token.
Detailed Explanation
The issue is caused by the improper handling of translation strings containing the %s (from %suggest%) token by the sprintf() function in Pimcore admin-ui-classic-bundle. Ideally, the translation value should be output directly to the user as plain text. However, the incorrect parsing of these translation strings allows the malicious user to potentially manipulate and exploit the dialog box.
An attacker with comparatively lower access can exploit this vulnerability since the "translation permission" cannot be scoped to specific modules. This means that low-level users might still have access to translations, allowing a skilled attacker to take advantage of the situation.
Commit and Patch
The Pimcore team has quickly addressed this issue and released a patch to fix it. The patch is present in commit abd77392 and has been included in the Pimcore admin-ui-classic-bundle release version 1.1.2. The patch is responsible for properly handling the translation strings with %s and preventing potential unauthorized access to the application.
Here's a snippet of the patch for reference
// Original code (vulnerable)
// ...
sprintf(suggestTranslation, value);
// ...
// Patched code (fixed)
// ...
escape_sprintf(suggestTranslation, value);
// ...
If you are using a previous version of Pimcore admin-ui-classic-bundle, it is highly recommended that you update to the latest version 1.1.2. Alternatively, you can also apply the patch manually to your existing installation by following the changes documented in commit abd77392.
Original References
You can find the original references for this issue, including the commit details, patch, and release notes, by following these links:
- Commit Details: https://github.com/pimcore/pimcore/commit/abd77392
- Patch: https://github.com/pimcore/pimcore/commit/abd77392.diff
- Release Notes: https://github.com/pimcore/pimcore/releases/tag/1.1.2
Conclusion
CVE-2023-42817 is a critical security vulnerability in Pimcore admin-ui-classic-bundle that allows unauthorized access to the application through the exploitation of translation string parsing. Users are strongly advised to update their Pimcore admin-ui-classic-bundle to version 1.1.2 or apply the patch manually to secure their applications against potential attacks. By staying informed and vigilant, we can continue to build a safe and secure application environment for everyone.
Timeline
Published on: 09/25/2023 19:15:10 UTC
Last modified on: 09/26/2023 15:57:45 UTC