XSS in choose time value Classes Data Objects in pimcore/pimcore

Valid

Reported on

Apr 27th 2023


Description

XSS in choose time value Classes Data Object

Proof of Concept

Login in URL : https://demo.pimcore.fun/admin Go to Settings-> Data Objects -> Classes -> News (NE) -> Dates & Images in tab Dates & Images , inject payload to value time at Specific Settings

// PoC
payload : \"><svg><animate onbegin=prompt(document.domain) attributeName=x dur=1s>
video PoC: https://drive.google.com/file/d/1yk5jvyTVP1pJf7Dpf-waKo06K2b_Gz0p/view?usp=sharing

Impact

An attacker can use XSS to send a malicious script to any user.

We are processing your report and will contact the pimcore team within 24 hours. 5 months ago
pimcore/pimcore maintainer has acknowledged this report 5 months ago
HMs modified the report
5 months ago
robertst7
4 months ago

Maintainer


Thanks for finding this issue, but I couldn't reproduce it and tried to watch the video, but I don't have access. Could you please give me access to watch it? Thanks

HMs
4 months ago

Researcher


sorry ..you can access here: https://drive.google.com/file/d/1yk5jvyTVP1pJf7Dpf-waKo06K2b_Gz0p/view?usp=sharing POC:

  1. Login in URL : https://demo.pimcore.fun/admin
  2. Go to Settings-> Data Objects -> Classes -> News (NE) -> Dates & Images
  3. in tab Dates & Images , inject payload to value time at Specific Settings
HMs
4 months ago

Researcher


Hi these, Any update ?

HMs
3 months ago

Researcher


????????????????????????????????????????

Divesh Pahuja
2 months ago

Maintainer


@hieuminhnv Hi, It seems this is duplicate of https://huntr.dev/bounties/7336b71f-a36f-4ce7-a26d-c8335ac713d6/ and already fixed in 10.5.21 version.

HMs
2 months ago

Researcher


hi @Divesh Pahuja, vuln in reporter https://huntr.dev/bounties/7336b71f-a36f-4ce7-a26d-c8335ac713d6/ has report on version 10.5.19 and fixed in 10.5.20 and was made public before I found this bug in 10.5.21 . why duplicate ??? One more , the bug on the other reporter is on fromDate or toDate field , and here's on TIME field Too confusing, hazz . okey, bye

robertst7
2 months ago

Maintainer


Hi @HMs, sorry but I am not able to reproduce this on 10.6. Could you please try it on our latest 10.6 version, because we no longer maintain 10.5. Thanks

robertst7
a month ago

Maintainer


Hi @hieuminhnv we are now able to reproduce this and we are working on it. Thanks for finding this

robertst7 validated this vulnerability a month ago
HMs has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Divesh Pahuja marked this as fixed in 10.6.8 with commit 234c0c a month ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
Divesh Pahuja published this vulnerability a month ago
to join this conversation