CVE-2024-24822: Pimcore Admin Classic Bundle Auth Bypass

CVE-2024-24822 Overview

CVE-2024-24822 is a critical Missing Authorization vulnerability affecting Pimcore's Admin Classic Bundle, which provides a backend user interface for the Pimcore content management platform. Prior to version 1.3.3, an attacker can create, delete, and modify tags without having the required permission to do so. This vulnerability stems from missing permission checks in the TagsController, allowing unauthorized users to manipulate tag resources.

Critical Impact

Unauthenticated attackers can perform unauthorized tag operations including creation and deletion, potentially leading to data integrity issues and denial of service through resource manipulation.

Affected Products

• Pimcore Admin Classic Bundle versions prior to 1.3.3
• pimcore:admin_classic_bundle (all versions before the security patch)

Discovery Timeline

• 2024-02-07 - CVE-2024-24822 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24822

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when a web application does not perform access control checks to verify that a user is authorized to perform the requested action. In the context of Pimcore's Admin Classic Bundle, the TagsController.php file lacked proper permission verification before executing tag-related operations.

The vulnerability allows unauthenticated or low-privileged users to interact with the tag management functionality without possessing the tags_configuration permission. This represents a complete bypass of the intended access control mechanism, enabling attackers to create arbitrary tags, delete existing tags, and potentially disrupt content organization and workflow processes within the Pimcore CMS.

Root Cause

The root cause of CVE-2024-24822 is the absence of permission checks in the TagsController class. Specifically, the addAction method (and likely other tag manipulation methods) did not call the checkPermission() function to verify that the requesting user had the required tags_configuration permission before processing tag operations.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction and no prior authentication. An attacker can exploit this vulnerability by directly sending HTTP requests to the Pimcore admin endpoints responsible for tag management. Since no permission verification is performed, the application processes these requests regardless of the attacker's authorization level.

// Security patch in src/Controller/Admin/TagsController.php
// Fix: Tag access rights (#412)
      */
     public function addAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         try {
             $tag = new Tag();
             $tag->setName(strip_tags($request->get('text', '')));

Source: GitHub Commit 24660b6d

Detection Methods for CVE-2024-24822

Indicators of Compromise

• Unexpected creation or deletion of tags in the Pimcore admin interface
• Unusual HTTP requests to /admin/tags/add, /admin/tags/delete, or similar tag management endpoints
• Log entries showing tag operations from unauthorized or unauthenticated sessions
• Anomalous patterns in tag-related database tables indicating bulk manipulation

Detection Strategies

• Monitor web application logs for requests to tag controller endpoints from sessions lacking appropriate permissions
• Implement web application firewall (WAF) rules to detect and alert on unusual tag management activity patterns
• Audit Pimcore access logs for tag operations performed by users without tags_configuration permissions
• Deploy runtime application self-protection (RASP) to detect authorization bypass attempts

Monitoring Recommendations

• Enable detailed logging for all Pimcore admin controller actions
• Configure alerting for tag creation or deletion events outside normal business operations
• Implement database-level auditing on tag-related tables to track unauthorized modifications
• Review access control configurations regularly to ensure proper permission assignments

How to Mitigate CVE-2024-24822

Immediate Actions Required

• Upgrade Pimcore Admin Classic Bundle to version 1.3.3 or later immediately
• Audit existing tags for unauthorized modifications or suspicious entries
• Review application logs for evidence of exploitation prior to patching
• Temporarily restrict network access to the Pimcore admin interface if immediate patching is not possible

Patch Information

The fix for CVE-2024-24822 is available in Pimcore Admin Classic Bundle version 1.3.3. The security patch adds the missing $this->checkPermission('tags_configuration') call to tag manipulation methods in TagsController.php, ensuring proper authorization verification before processing requests.

For detailed information about the fix, refer to:

• GitHub Security Advisory GHSA-3rfr-mpfj-2jwq
• GitHub Pull Request #412
• Security Patch Commit

Workarounds

• Apply the patch manually by adding the $this->checkPermission('tags_configuration') check to the TagsController.php file
• Implement network-level access controls to restrict access to the Pimcore admin interface to trusted IP addresses only
• Deploy a reverse proxy or WAF rule to block unauthorized requests to tag management endpoints
• Disable or restrict access to tag functionality at the application level until the official patch can be applied

# Update Pimcore Admin Classic Bundle to patched version
composer update pimcore/admin-ui-classic-bundle --with-dependencies

# Verify the installed version
composer show pimcore/admin-ui-classic-bundle | grep version
# Expected output: version >= 1.3.3