{"id":"GHSA-fx6j-9pp6-ph36","aliases":["CVE-2024-41109"],"title":"Pimcore vulnerable to disclosure of system and database information behind /admin firewall","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\n\nNavigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.\n\n> The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.\n\n### Details\n\n`/admin/index/statistics` returns the following JSON-response:\n```\n{\n    {\n        \"instanceId\": \"...\",\n        \"pimcore_major_version\": 11,\n        \"pimcore_version\": \"v11.3.1\",\n        \"pimcore_hash\": \"3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008\",\n        \"pimcore_platform_version\": \"v2024.2\",\n        \"php_version\": \"8.3.8\",\n        \"mysql_version\": \"10.11.8-MariaDB-ubu2204\",\n    \"bundles\": [\n        // all installed bundles\n    ],\n    \"tables\": [\n        // all tables and their row count, e.g:\n        {\n            \"name\": \"users\",\n            \"rows\": 2\n        },\n    ]\n}\n```\n\nInformation about the Pimcore Version can also be seen here:\n\nIn a current Version:\n![[image](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)\n![[image](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)\n\nIn Pimcore Version 10.6.9:\n![[image](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)\n![[image](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)\n\n### PoC\n\n- [[Demo App](https://demo.pimcore.fun/admin)](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo\n- Watching Network-Tab in Developer-Tools and looking for `/admin/index/statistics`\n\n### Impact\n\nOnly for logged in Pimcore users possible.\n\n### Workaround and Patch\n\nWe patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.\nThis resolves navigating to `/admin/index/statistics`.\n\n```patch\ndiff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php\n--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)\n+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)\n@@ -15,6 +15,7 @@\n\nnamespace Pimcore\\Bundle\\AdminBundle\\Controller\\Admin;\n\n+use App\\Constant\\UserPermission;\nuse Doctrine\\DBAL\\Connection;\nuse Exception;\nuse Pimcore\\Analytics\\Google\\Config\\SiteConfigProvider;\n@@ -142,6 +143,12 @@\nthrow $this->createAccessDeniedHttpException();\n}\n\n+        $user = $this->tokenResolver->getUser();\n+\n+        if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n+            throw $this->createAccessDeniedException();\n+        }\n+\n// DB\ntry {\n$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES\n````\n\nFor the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:\n\n```php\n<?php\n\nnamespace App\\EventListener\\Admin;\n\nuse App\\Constant\\UserPermission;\nuse Pimcore\\Bundle\\AdminBundle\\Event\\AdminEvents;\nuse Pimcore\\Event\\Admin\\IndexActionSettingsEvent;\nuse Pimcore\\Security\\User\\TokenStorageUserResolver;\nuse Symfony\\Component\\EventDispatcher\\EventSubscriberInterface;\n\n/**\n* @deprecated and cannot be used in Pimcore 11\n*/\nclass PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface\n{\n    public function __construct(private readonly TokenStorageUserResolver $tokenResolver)\n    {\n    }\n\n    public static function getSubscribedEvents()\n    {\n        return [\n            AdminEvents::INDEX_ACTION_SETTINGS => ['onIndexActionSettingsEvent'],\n        ];\n    }\n\n    public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void\n    {\n        $user = $this->tokenResolver->getUser();\n        if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n            return;\n        }\n\n        $settings = $event->getSettings();\n        $settings['instanceId'] = '';\n        $settings['version'] = '';\n        $settings['build'] = '';\n        $event->setSettings($settings);\n    }\n}\n```","severity":"medium","score":6.3,"published":"2024-07-30T14:52:51.000Z","modified":"2026-09-10T03:50:16.645Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pimcore/admin-ui-classic-bundle","sources":[{"name":"OSV · GHSA-fx6j-9pp6-ph36","url":"https://osv.dev/vulnerability/GHSA-fx6j-9pp6-ph36"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.5.2"}],"type":"ECOSYSTEM"}],"versions":["1.4.0","v1.0.0","v1.0.0-BETA1","v1.0.0-RC1","v1.0.0-RC2","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.1.0","v1.1.0-RC1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.2","v1.2.0-RC1","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.0-RC1","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.5.0","v1.5.0-RC1","v1.5.0-RC2","v1.5.1"],"fixed":["1.5.2"]}],"sourceAffected":[],"references":["https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36","https://nvd.nist.gov/vuln/detail/CVE-2024-41109","https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0","https://github.com/pimcore/admin-ui-classic-bundle","https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40","https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"],"sources":[{"name":"OSV","id":"GHSA-fx6j-9pp6-ph36","modified":"2026-09-10T03:50:16.645355558Z","url":"https://osv.dev/vulnerability/GHSA-fx6j-9pp6-ph36"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:45:31.121Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}