CVE-2023-30850
📋 TL;DR
CVE-2023-30850 is a SQL injection vulnerability in Pimcore's admin translations API that allows authenticated attackers to execute arbitrary SQL commands. This affects Pimcore installations before version 10.5.21. Attackers could potentially read, modify, or delete database content.
💻 Affected Systems
- Pimcore
📦 What is this software?
Pimcore by Pimcore
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, data manipulation, or privilege escalation within the Pimcore application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
Exploitation requires authenticated admin access to the vulnerable API endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.5.21
Vendor Advisory: https://github.com/pimcore/pimcore/security/advisories/GHSA-jwg4-qcgv-5wg6
Restart Required: Yes
Instructions:
1. Backup your Pimcore installation and database. 2. Update Pimcore to version 10.5.21 or later via composer: 'composer require pimcore/pimcore:^10.5.21'. 3. Clear cache and restart web server.
🔧 Temporary Workarounds
Manual patch application
allApply the security patch from GitHub commit without full upgrade
Apply patch from: https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch
🧯 If You Can't Patch
- Restrict access to admin translations API endpoint using web application firewall rules
- Implement additional input validation and parameterized queries for all SQL operations
🔍 How to Verify
Check if Vulnerable:
Check Pimcore version via admin interface or by examining composer.lock file for pimcore/pimcore versionCheck Version:
composer show pimcore/pimcore | grep versionVerify Fix Applied:
Confirm version is 10.5.21 or later and verify patch files are present📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin translations API access
- Unexpected database schema changes
Network Indicators:
- Unusual traffic patterns to /admin/translations/* endpoints
- SQL error messages in HTTP responses
SIEM Query:
source="web_server" AND (uri="/admin/translations/*" AND (status=500 OR response_size>10000))🔗 References
- https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch
- https://github.com/pimcore/pimcore/pull/14952
- https://github.com/pimcore/pimcore/security/advisories/GHSA-jwg4-qcgv-5wg6
- https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch
- https://github.com/pimcore/pimcore/pull/14952
- https://github.com/pimcore/pimcore/security/advisories/GHSA-jwg4-qcgv-5wg6
