Pimcore Vulnerable to PHP Object Injection Attacks
Published 17 May 2022 · Updated 13 Apr 2025
Affected package
- Affected
- >=1.4.9 <2.2.0
- Fixed in
- 2.2.0
composer require pimcore/pimcore:^2.2.0Details
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.
Is GHSA-g7pj-3v97-3vxp in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2014-2921
- Linkgithub.com/pimcore/pimcore/commit/3cb2683e669b5644f180d362cfa9614c09bef280
- Linkgithub.com/pedrib/PoC/blob/caa03645e256a8b50f1101c983d39586ebc467ee/advisories/pimcore-2.1.0.txt
- Linkgithub.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
- Packagegithub.com/pimcore/pimcore
- Linkopenwall.com/lists/oss-security/2014/04/21/1
- Linkwww.pimcore.org/en/resources/blog/pimcore+2.2+released_b442
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.