Headline
CVE-2022-3255: Reflected XSS In User/Roles Function in pimcore
If an attacker can control a script that is executed in the victim’s browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
Description
URL: https://demo.pimcore.fun/admin/
In Setting select User/Roles and select User. After created user, move to Workspace tab and inject payload XSS at Documents, Assets and Data Objects. XSS payload will be trigger.
Besides, Workspace in Roles Also having the same situation. Can you create Role and move to Workspace tab and inject payload to Documents, Assets, Data Objectes.
Proof of Concept
//
payload = "><img src=x onerror=alert(2)>
Image PoC: ![PoC_Image] (https://drive.google.com/file/d/1oUR2JXF8jQ1YMpuKNNqKe8TAJaCuZwL8/view?usp=sharing “poc”)
Impact
If an attacker can control a script that is executed in the victim’s browser, then they can typically fully compromise that user. Amongst other things, the attacker can:
Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
Related news
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can perform any action within the application that the user can perform; view any information that the user is able to view; modify any information that the user is able to modify; and/or initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user. A patch for this issue is available at commit 1e916e7d668c9e47b217e20cc0ea4812f466201b and anticipated to be part of version 10.5.7.