Medium, CVSS 4.3PackagistPublished
Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list
CVE-2024-21665 · GHSA-cx99-25hr-5jxf
- Affected
- Packagist pimcore/ecommerce-framework-bundle < 1.0.10
- Fixed in
- 1.0.10· Vendor fix available
- Issue
- An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Details Permissions do not seem to be enforced when reaching the admin/ecommerceframework/admin-order/list endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place : <https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c56970363596e5c21/src/Controller/AdminOrderController.php#L98 Note : Testing this vulnerability requires a fully configured ecommerce website, but it looks vulnerable as when requesting the endpoint the data seem returned (and when looking at the source code nothing seems to validate the permissions on the specified endpoint). PoC In order to reproduce the issue, the following steps can be followed : 1. As an administrator : a. Create a role without any permission through…
Recommended action: Upgrade to 1.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.