Executive Summary

This vulnerability exists in Pimcore CMS/DXP version 12.3.8 and involves a sandbox bypass. Authenticated administrative attackers can exploit empty implementations of checkMethodAllowed() and checkPropertyAllowed() in the custom Twig SecurityPolicy. By supplying malicious Twig templates through the DataObject ClassDefinition Layout\Text component, attackers can execute arbitrary methods on PHP objects.

This allows attackers to perform arbitrary file reads, execute arbitrary database queries, and potentially achieve remote code execution using PHP object gadget chains. The vulnerability is further widened by the pimcore_* function wildcard, which bypasses restrictions on all Pimcore Twig functions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive files, execution of arbitrary database queries, and potentially full remote code execution on the affected system.

Since the attacker needs authenticated administrative access, the risk is particularly high in environments where administrative credentials are compromised or insufficiently protected.

Successful exploitation could lead to data breaches, system compromise, and loss of control over the affected Pimcore CMS/DXP instance.

Useful 0 Not Useful 0