Server-Side Request Forgery (SSRF) in pimcore/pimcore


Reported on

Oct 21st 2021


Your demo server is running in a vulnerable Apache server (Apache/2.4.38). The attacker can easily exploit SSRF vulnerability just by visiting a crafted URL. The vulnerability has been discovered few days ago and it relies on mod_proxy module. I know that this vulnerability is not directly related to the project, but still i wanted to notice you about the issue.

Proof of Concept

Just visiting the following URL, an attacker can force the server to perform HTTP requests (URL to visit is specified at the end of the payload). In this case I'm using to check if the request is succesfully performed:|


Attackers can exploit SSRF, forcing the server to perform HTTP requests. Please upgrade your apache server and/or disable the mod_proxy module as a mitigiation.

We have contacted a member of the pimcore team and are waiting to hear back 2 years ago
lfama modified the report
2 years ago
Bernhard Rusch validated this vulnerability 2 years ago
lfama has been awarded the disclosure bounty
The fix bounty is now up for grabs
Bernhard Rusch
2 years ago


Thanks a lot for reporting - problem fixed.

Bernhard Rusch marked this as fixed with commit 338fcc 2 years ago
Bernhard Rusch has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation