GHSA-3234-gxc3-pq6f: Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
SummaryThe columnConfigAction endpoint in the CustomReportsBundle is vulnerable to SQL injection. An attacker with the reports_config permission can supply a malicious SQL configuration that is concatenated into a query and executed. Although the application attempts to filter certain DDL/DML keywords (like UPDATE, DELETE, DROP), it fails to prevent arbitrary SELECT queries, UNION statements, or the use of dangerous database functions. Furthermore, because the application returns database error messages in the JSON response, an attacker can easily exfiltrate data using error-based SQL injection techniques.Affected scopebundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php
CustomReportController:columnConfigAction -> SqlAdapter::getColumns -> SqlAdapter::buildQueryString -> Db::fetchAssociative()DetailsThe columnConfigAction endpoint in ``` bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:197 ``` receives a configuration JSON string from the request body.The configuration is decoded and the first element is extracted in ```bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:207-208.```The Sql adapter is instantiated based on the user-controlled type field in ```bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:216.```The controller calls getColumnsWithMetadata in ```bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:217```, which in turn calls getColumns in ```bundles/CustomReportsBundle/src/Tool/Adapter/AbstractAdapter.php:47```.The Sql::getColumns method in``` bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:60``` calls buildQueryString at ```bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:64.```buildQueryString in ```bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:81``` concatenates various fields from the user-providedconfiguration (like sql, from, where) directly into the SQL query string (lines 89, 100, 107).The constructed SQL string is checked against a weak regex in ```bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:67```, which can be bypassed using comments __(e.g. UPDATE/**/)__ or by using permitted SELECT statements to exfiltrate data from unauthorized tables.The query is executed without parameterization using ```$db->fetchAssociative($sql)``` in ```bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:70.```Any resulting database exception is caught in the controller and the error message is returned in the JSON response at ```bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:234```, enabling error-based exfiltration.PoCDownload and install the version Pimcore <=12.3.3 (latest)Login using Admin account or any account that has reports_config permissionNavigate to custom reportsCapture the request using burp suite and perform SQLi attack as the followingGet Database usernameGet Database nameGet Tables names
__Note__: Update the limit parameter to iterate around the tables queries like limit 0,1 limit 1,1 , limit 2,1 ..etcBypass the implemented Regex and perform SQL updat eto for exmaple update the admin usernameImpactBy exploiting this vulneability any user with custom-report access could manipuate and crawl the database information and also bypass the application filters to Update,insert or delete database tables, which impact on the application confidentiality ,intergrity and service availability
CVSS v3.1: 8.7