Pimcore contains Unrestricted Upload of File with Dangerous Type
Published 2 Feb 2023 · Updated 16 Feb 2024
Affected package
- Affected
- <10.5.16
- Fixed in
- 10.5.16
composer require pimcore/pimcore:^10.5.16Details
Impact
The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain.
Patches
Update to version 10.5.16 or apply this patch manually https://github.com/pimcore/pimcore/pull/14125.patch
Is GHSA-8xv4-jj4h-qww6 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.
References
- Linkgithub.com/pimcore/pimcore/security/advisories/GHSA-8xv4-jj4h-qww6
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-23937
- Linkgithub.com/pimcore/pimcore/pull/14125
- Linkgithub.com/pimcore/pimcore/commit/75a448ef8ac74424cf4e723afeb6d05f9eed872f
- Packagegithub.com/pimcore/pimcore
- Linkhuntr.dev/bounties/aa7ee076-d729-4fcc-9bcc-48bcbb8eac38
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.