Stored XSS via name parameter of "Predefined Properties" in pimcore/pimcore

Valid

Reported on

Mar 21st 2023


Description

It's observed that the name parameter of the "Predefined Properties" functionality is vulnerable to stored XSS.

Proof of Concept

1.Login to https://demo.pimcore.fun/admin/.

2.Now go to Settings -> Predefined Properties -> Add and Enter the payload: ```"><img src=1 onerror=alert(document.domain)>``` inside the name input field.

3.Then click on update.

4.Now delete the name, you will see XSS will trigger.

Video PoC

https://drive.google.com/file/d/1kQjTzLNpuzZRySUt19IBn3T7ABvMRxem/view?usp=share_link

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

References

We are processing your report and will contact the pimcore team within 24 hours. a year ago
We have contacted a member of the pimcore team and are waiting to hear back a year ago
Pavlos has marked this vulnerability as a duplicate of 41edf190-f6bf-4a29-a237-7ff1b2d048d3 a year ago

Please add it to the above report as an occurrence. Opening more than 1 report per vulnerability type by circumventing our bundling system can result in a ban.

The disclosure bounty has been dropped
The fix bounty has been dropped
The researcher's credibility has decreased: -5
SAMPRIT DAS
a year ago

Researcher


Hi @psmoros i have updated the report https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3/ and added this as occurrence

SAMPRIT DAS modified the report
10 months ago
SAMPRIT DAS
10 months ago

Researcher


@dvesh3 @maintainer Now please validate the report and the occurrences.

SAMPRIT DAS modified the report
10 months ago
Divesh Pahuja validated this vulnerability 9 months ago
sampritdas8 has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Divesh Pahuja marked this as fixed in 10.5.21 with commit 7a7993 9 months ago
The fix bounty has been dropped
Divesh Pahuja
9 months ago

Maintainer


@admin how can i find the published CVE for this fix? thanks!

SAMPRIT DAS
9 months ago

Researcher


@admin please help

Ben Harvie
9 months ago

Admin


Hi, the CVE is assigned and will update to published shortly. Thanks!

to join this conversation