CVE-2023-46722 (Other, published 2023-10-31T16:15Z)
Description: value: The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
src/Controller/Admin/Asset/AssetController.php
templates/admin/asset/get_preview_pdf_in_progress.html.twig
templates/admin/asset/get_preview_pdf_unsafe.html.twig
templates/admin/asset/show_version_document.html.twig
translations/admin.en.yaml
Commit message: [Improvement]: Add sanitizing pdf (#301)

* Improve: add sanitizing pdf

* Review changes - use scan instead of sanitizing

* Review changes

* Update translations/admin.en.yaml

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Review changes

* Update src/Controller/Admin/Asset/AssetController.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update src/Controller/Admin/Asset/AssetController.php

Co-authored-by: aryaantony92 <97134765+aryaantony92@users.noreply.github.com>

---------

Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>
Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>
Co-authored-by: aryaantony92 <97134765+aryaantony92@users.noreply.github.com>

Vulnerable code:
     *
     * @param Request $request
     *
     * @return StreamedResponse
    public function getPreviewDocumentAction(Request $request): StreamedResponse
        if (!$stream && $asset->getPageCount() && \Pimcore\Document::isAvailable() && \Pimcore\Document::isFileTypeSupported($asset->getFilename())) {
    

Fixed code:
use Pimcore\Messenger\AssetUpdateTasksMessage;
        if ($asset->getMimeType() === 'application/pdf') {
            $scanResponse = $this->getResponseByScanStatus($asset, false);
            if ($scanResponse) {
                return $scanResponse;
            }
        }

    public function getPreviewDocumentAction(
        Request $request,
        TranslatorInterface $translator
    ): StreamedResponse|Response
            if ($asset->getMimeType() === 'application/pdf') {
                $scanResponse = $this->getResponseByScanStatus($asset);
                if ($scanResponse) {
                    return $scanResponse;
                }
            }

    private function getResponseByScanStatus(Asset\Document $asset, bool $processBackground = true) :?Response
    {
        if (!Config::getSystemConfiguration('assets')['document']['scan_pdf']) {
            return null;
        }

        $scanStatus = $asset->getScanStatus();
        if ($scanStatus === null) {
            $scanStatus = Asset\Enum\PdfScanStatus::IN_PROGRESS;
            if ($processBackground) {
                \Pimcore::getContainer()->get('messenger.bus.pimcore-core')->dispatch(
                    new AssetUpdateTasksMessage($asset->getId())
                );
            }
        }

        return match($scanStatus) {
            Asset\Enum\PdfScanStatus::IN_PROGRESS => $this->render('@PimcoreAdmin/admin/asset/get_preview_pdf_in_progress.html.twig'),
            Asset\Enum\PdfScanStatus::UNSAFE => $this->render('@PimcoreAdmin/admin/asset/get_preview_pdf_unsafe.html.twig'),
            default => null,
        };
    }

        if (
            !$stream &&
            $asset->getPageCount() &&
            \Pimcore\Document::isAvailable() &&
            \Pimcore\Document::isFileTypeSupported($asset->getFilename())
        ) {
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">

    <style>

        /* hide from ie on mac \*/
        html {
            height: 100%;
            overflow: hidden;
        }
        /* end hide */

        body {
            height: 100%;
            margin: 0;
            padding: 0;
            background: #EEE;
        }

        #container {
            text-align: center;
            position: absolute;
            top:50%;
            margin-top: -200px;
            width: 100%;
        }

        #message {
            margin-left: 8px;
        }

    </style>

    <script {{ pimcore_csp.getNonceHtmlAttribute()|raw }}>
        window.setTimeout(() => {
            window.location.reload();
        }, 5000)
    </script>
</head>

<body>

<div id="container">
    <span id="message">{{ 'pdf_scan_in_progress'|trans([], 'admin') }}</span>
</div>


</body>
</html>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">

    <style>

        /* hide from ie on mac \*/
        html {
            height: 100%;
            overflow: hidden;
        }
        /* end hide */

        body {
            height: 100%;
            margin: 0;
            padding: 0;
            background: #EEE;
        }

        #container {
            text-align: center;
            position: absolute;
            top:50%;
            margin-top: -200px;
            width: 100%;
        }

        #warning {
            position: relative;
            width: 40px;
            height: 40px;
            top: 13px;
        }

        #message {
            margin-left: 8px;
        }

    </style>

</head>

<body>

<div id="container">
    <img alt="warning" id="warning" src="/bundles/pimcoreadmin/img/flat-color-icons/overlay-error.svg" />
    <span id="message">{{ 'pdf_js_unsafe'|trans([], 'admin') }}</span>
</div>


</body>
</html>

pdf_js_unsafe: This PDF file contains JavaScript. If you want to view it, please download and open it in your local PDF viewer.
pdf_scan_in_progress: 'Preview not available: PDF is being scanned. This may take a while.'