Pimcore getObjectByToken function PHP Object Injection Vulnerability

Release date:
Updated on:

Affected Systems:
Pimcore 1.4.9-2.1.0
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-2922
 
Pimcore is an open source Web content management platform.
 
Pimcore 1.4.9-2.1.0, Newsletter in the Pimcore_Tool_Newsletter module. the php function getObjectByToken does not properly process the objects obtained when deserializing the path name. This allows remote attackers to execute PHP Object injection attacks and delete arbitrary files through the Zend_Http_Response_Stream object vector.
 
<* Source: Pedro Ribeiro

Link: https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:
 
If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:
 
* Do not send suspicious input to the unserialize function. Use JSON encoding/decoding instead of unserialize.
 
Vendor patch:
 
Pimcore
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 

Https://github.com/pimcore/pimcore/commit/3cb2683e669b5644f180d362cfa9614c09bef280
Https://github.com/pimcore/pimcore/commit/db18317af47de1de9f9ec6d83db1c2d353d06db7