{"id":"CVE-2024-41109","aliases":["GHSA-fx6j-9pp6-ph36"],"url":"https://o3.security/vulnerability/CVE-2024-41109","summary":"Pimcore vulnerable to disclosure of system and database information behind /admin firewall","details":"### Summary\n\nNavigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.\n\n> The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.\n\n### Details\n\n`/admin/index/statistics` returns the following JSON-response:\n```\n{\n    {\n        \"instanceId\": \"...\",\n        \"pimcore_major_version\": 11,\n        \"pimcore_version\": \"v11.3.1\",\n        \"pimcore_hash\": \"3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008\",\n        \"pimcore_platform_version\": \"v2024.2\",\n        \"php_version\": \"8.3.8\",\n        \"mysql_version\": \"10.11.8-MariaDB-ubu2204\",\n    \"bundles\": [\n        // all installed bundles\n    ],\n    \"tables\": [\n        // all tables and their row count, e.g:\n        {\n            \"name\": \"users\",\n            \"rows\": 2\n        },\n    ]\n}\n```\n\nInformation about the Pimcore Version can also be seen here:\n\nIn a current Version:\n![[image](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)\n![[image](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)](https://github.com/user-attachments/assets/152f6ad7-2cb3-42eb-bf05-1066a3496d59)\n\nIn Pimcore Version 10.6.9:\n![[image](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)](https://github.com/user-attachments/assets/907fb8d8-81b3-450f-bdb0-3e6193bfc243)\n![[image](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)](https://github.com/user-attachments/assets/c4d89b88-f458-4023-a29f-d2ef652b2c3b)\n\n### PoC\n\n- [[Demo App](https://demo.pimcore.fun/admin)](https://demo.pimcore.fun/admin) with credentials user: admin and pass: demo\n- Watching Network-Tab in Developer-Tools and looking for `/admin/index/statistics`\n\n### Impact\n\nOnly for logged in Pimcore users possible.\n\n### Workaround and Patch\n\nWe patched the following additional check for Pimcore v10.6.9. This uses an app-specific class but any user permission would be ok.\nThis resolves navigating to `/admin/index/statistics`.\n\n```patch\ndiff --git a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php\n--- a/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (revision dd81ef4c666b18c254333867a60f6ed455025076)\n+++ b/vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/IndexController.php    (date 1721225746781)\n@@ -15,6 +15,7 @@\n\nnamespace Pimcore\\Bundle\\AdminBundle\\Controller\\Admin;\n\n+use App\\Constant\\UserPermission;\nuse Doctrine\\DBAL\\Connection;\nuse Exception;\nuse Pimcore\\Analytics\\Google\\Config\\SiteConfigProvider;\n@@ -142,6 +143,12 @@\nthrow $this->createAccessDeniedHttpException();\n}\n\n+        $user = $this->tokenResolver->getUser();\n+\n+        if (!$user->isAdmin() && !$user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n+            throw $this->createAccessDeniedException();\n+        }\n+\n// DB\ntry {\n$tables = $db->fetchAllAssociative('SELECT TABLE_NAME as name,TABLE_ROWS as `rows` from information_schema.TABLES\n````\n\nFor the Pimcore versions in the UI we used the IndexActionSettingsEvent. This works for Versions < Pimcore 11:\n\n```php\n<?php\n\nnamespace App\\EventListener\\Admin;\n\nuse App\\Constant\\UserPermission;\nuse Pimcore\\Bundle\\AdminBundle\\Event\\AdminEvents;\nuse Pimcore\\Event\\Admin\\IndexActionSettingsEvent;\nuse Pimcore\\Security\\User\\TokenStorageUserResolver;\nuse Symfony\\Component\\EventDispatcher\\EventSubscriberInterface;\n\n/**\n* @deprecated and cannot be used in Pimcore 11\n*/\nclass PimcoreVersionUIGuardSubscriber implements EventSubscriberInterface\n{\n    public function __construct(private readonly TokenStorageUserResolver $tokenResolver)\n    {\n    }\n\n    public static function getSubscribedEvents()\n    {\n        return [\n            AdminEvents::INDEX_ACTION_SETTINGS => ['onIndexActionSettingsEvent'],\n        ];\n    }\n\n    public function onIndexActionSettingsEvent(IndexActionSettingsEvent $event): void\n    {\n        $user = $this->tokenResolver->getUser();\n        if ($user->isAdmin() || $user->isAllowed(UserPermission::ADMIN_INDEX_VIEW)) {\n            return;\n        }\n\n        $settings = $event->getSettings();\n        $settings['instanceId'] = '';\n        $settings['version'] = '';\n        $settings['build'] = '';\n        $event->setSettings($settings);\n    }\n}\n```","published":"2024-07-30T14:43:14.407Z","modified":"2026-08-12T03:51:14.383944198Z","cvss":{"score":6.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"pimcore/admin-ui-classic-bundle","fixedVersion":"1.5.2"}],"fix":{"url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0","label":"pimcore/admin-ui-classic-bundle@afa10bf"},"references":[{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.5.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41109.json"},{"type":"ADVISORY","url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-fx6j-9pp6-ph36"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41109"},{"type":"FIX","url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/afa10bff2f8bfe9c8af7b6b75885bc403f6984f0"},{"type":"PACKAGE","url":"https://github.com/pimcore/admin-ui-classic-bundle"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.383944198Z"}}