CVE-2024-32871 (PHP, published 2024-06-04T15:15Z)
Description: value: Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/CoreBundle/src/DependencyInjection/Configuration.php
doc/04_Assets/03_Working_with_Thumbnails/01_Image_Thumbnails.md
doc/04_Assets/03_Working_with_Thumbnails/README.md
doc/23_Installation_and_Upgrade/09_Upgrade_Notes/README.md
models/Asset/Document/ImageThumbnail.php
models/Asset/Image/Thumbnail.php
models/Asset/Thumbnail/ImageThumbnailTrait.php
models/Asset/Video/ImageThumbnail.php
models/Exception/ThumbnailFormatNotSupportedException.php
models/Exception/ThumbnailMaxScalingFactorException.php
Commit message: Merge pull request from GHSA-277c-5vvj-9pwx

* Introduce allowed formats and max scale factor

* Add documentation, upgrade notes and use floatNode for max_scale_factor

* Update to max_scaling_factor

* Cast format to lower

* Fix typo

Vulnerable code:
> Using ImageMagick Pimcore supports hundreds of formats including: AI, EPS, TIFF, PNG, JPG, GIF, PSD, ...
This functionality allows true single source publishing with Pimcore. 
     * @throws \Exception

Fixed code:
                    ->arrayNode('thumbnails')
                    ->addDefaultsIfNotSet()
                        ->children()
                            ->arrayNode('allowed_formats')
                                ->defaultValue(['avif', 'eps', 'gif', 'jpeg', 'jpg', 'pjpeg', 'png', 'svg', 'tiff', 'webm', 'webp'])
                                ->scalarPrototype()->end()
                            ->end()
                            ->floatNode('max_scaling_factor')
                                ->defaultValue(5.0)
                            ->end()
                        ->end()
                    ->end()
> Using ImageMagick Pimcore can support hundreds of formats including: AI, EPS, TIFF, PNG, JPG, GIF, PSD, etc.
> Not all formats are allowed out of the box. To extend the list [see](./README.md#allowed-formats).
The high resolution scaling factor is limited to `5.0` eg. `@5x`. Float values are supported.
If you need to scale an image more than that, you can use the `max_scaling_factor` option in the configuration.
```yaml
  pimcore:
    assets:
      thumbnails:
        max_scaling_factor: 6.0
```

This functionality allows true single source publishing with Pimcore.

### Allowed formats
Pimcore allows the following formats for thumbnails out of the box:
`'avif', 'eps', 'gif', 'jpeg', 'jpg', 'pjpeg', 'png', 'svg', 'tiff', 'webm', 'webp'`.

If you want to use a different format, you can easily extend the list of supported formats.
Keep in mind that you must copy the whole list of formats and add your desired format to it.
```yaml
pimcore:
    assets:
        thumbnails:
            allowed_formats:
                - 'avif'
                - 'eps'
                - 'gif'
                - 'jpeg'
                - 'jpg'
                - 'pjpeg'
                - 'png'
                - 'svg'
                - 'tiff'
                - 'webm'
                - 'webp'
                - 'pdf' # Add your desired format here
```
## Pimcore 11.2.4
### Assets Thumbnails
- Thumbnail generation for Assets, Documents and Videos now only support the following formats out of the box: `'avif', 'eps', 'gif', 'jpeg', 'jpg', 'pjpeg', 'png', 'svg', 'tiff', 'webm', 'webp'`.
- You can extend this list by adding your formats on the bottom: 
```yaml
  pimcore:
    assets:
      thumbnails:
        allowed_formats:
          - 'avif'
          - 'eps'
          - 'gif'
          - 'jpeg'
          - 'jpg'
          - 'pjpeg'
          - 'png'
          - 'svg'
          - 'tiff'
          - 'webm'
          - 'webp'
          - 'pdf' # Add your desired format here
```
- High resolution scaling factor for image thumbnails has now been limited to a maximum of `5.0`. If you need to scale an image more than that, you can use the `max_scaling_factor` option in the configuration.
```yaml
  pimcore:
    assets:
      thumbnails:
        max_scaling_factor: 6.0
```

use Pimcore\Model\Exception\ThumbnailFormatNotSupportedException;
    /**
     * @throws ThumbnailFormatNotSupportedException
     */
        if (!$this->checkAllowedFormats($this->config->getFormat())) {
            throw new ThumbnailFormatNotSupportedException();
        }

use Pimcore\Model\Exception\ThumbnailFormatNotSupportedException;
use Pimcore\Model\Exception\ThumbnailMaxScalingFactorException;
     * @throws ThumbnailFormatNotSupportedException
     * @throws ThumbnailMaxScalingFactorException
        if (!$this->checkAllowedFormats($this->config->getFormat(), $this->asset)) {
            throw new ThumbnailFormatNotSupportedException();
        }

        if (!$this->checkMaxScalingFactor($this->config->getHighResolution())) {
            throw new ThumbnailMaxScalingFactorException();
        }

use Pimcore\Config as PimcoreConfig;

    private function checkAllowedFormats(string $format, ?Asset $asset = null): bool
    {
        $format = strtolower($format);
        if($asset) {
            $original = pathinfo($asset->getRealFullPath(),  PATHINFO_EXTENSION);
            if ($format === $original || $format === 'source') {
                return true;
            }
        }

        $assetConfig = PimcoreConfig::getSystemConfiguration('assets');
        return in_array(
            $format,
            $assetConfig['thumbnails']['allowed_formats'],
            true
        );
    }

    private function checkMaxScalingFactor(float $scalingFactor): bool
    {
        $assetConfig = PimcoreConfig::getSystemConfiguration('assets');
        return $scalingFactor <= $assetConfig['thumbnails']['max_scaling_factor'];
    }
use Exception;
use Pimcore\Model\Exception\ThumbnailFormatNotSupportedException;
     * @throws Exception
        if (!$this->checkAllowedFormats($this->config->getFormat())) {
            throw new ThumbnailFormatNotSupportedException();
        }

<?php
declare(strict_types=1);

/**
 * Pimcore
 *
 * This source file is available under two different licenses:
 * - GNU General Public License version 3 (GPLv3)
 * - Pimcore Commercial License (PCL)
 * Full copyright and license information is available in
 * LICENSE.md which is distributed with this source code.
 *
 *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
 *  @license    http://www.pimcore.org/license     GPLv3 and PCL
 */

namespace Pimcore\Model\Exception;

use Exception;

final class ThumbnailFormatNotSupportedException extends Exception
{
}
<?php
declare(strict_types=1);

/**
 * Pimcore
 *
 * This source file is available under two different licenses:
 * - GNU General Public License version 3 (GPLv3)
 * - Pimcore Commercial License (PCL)
 * Full copyright and license information is available in
 * LICENSE.md which is distributed with this source code.
 *
 *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
 *  @license    http://www.pimcore.org/license     GPLv3 and PCL
 */

namespace Pimcore\Model\Exception;

use Exception;

final class ThumbnailMaxScalingFactorException extends Exception
{
}