Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
Moderate severity
GitHub Reviewed
Published
Oct 31, 2023
in
pimcore/admin-ui-classic-bundle
•
Updated Nov 10, 2023
Description
Published by the National Vulnerability Database
Oct 31, 2023
Published to the GitHub Advisory Database
Nov 1, 2023
Reviewed
Nov 1, 2023
Last updated
Nov 10, 2023
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Proof of Concept
Step 1. Go to /admin and login.
Step 2. In Documents, go to home -> click on Sample Content -> click Document folder
Step 3. Upload file PDF content XSS payload
Patches
Apply patches
https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c.patch
https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9.patch
Workarounds
Update to version 1.2.0 or apply patches manually
https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c.patch
https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9.patch
References