CVE-2023-49075
📋 TL;DR
This vulnerability in Pimcore's Admin Classic Bundle disables two-factor authentication for non-admin security firewalls, allowing authenticated users to bypass 2FA requirements. It affects systems using the Admin Classic Bundle for Pimcore backend management. The issue was introduced in version 11 and fixed in version 1.2.2.
💻 Affected Systems
- Pimcore Admin Classic Bundle
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers with valid credentials can bypass 2FA entirely, gaining unauthorized access to sensitive administrative functions and potentially compromising the entire Pimcore instance.
Likely Case
Authenticated users (including lower-privileged accounts) can access systems without completing 2FA, potentially accessing data or functions beyond their intended permissions.
If Mitigated
With proper network segmentation and strong credential policies, impact is limited to specific administrative interfaces rather than full system compromise.
🎯 Exploit Status
Exploitation requires valid user credentials but no special tools or knowledge beyond normal authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2
Vendor Advisory: https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg
Restart Required: Yes
Instructions:
1. Update Admin Classic Bundle to version 1.2.2 via Composer: composer update pimcore/admin-ui-classic-bundle
2. Clear Symfony cache: php bin/console cache:clear
3. Restart web server services
🔧 Temporary Workarounds
Disable non-admin firewalls
allTemporarily disable non-admin security firewalls to force all users through admin firewall with 2FA
Modify security.yaml to comment out or remove non-admin firewall configurations
🧯 If You Can't Patch
- Implement network-level access controls to restrict access to Pimcore admin interfaces
- Enforce strict credential policies and monitor for unusual authentication patterns
🔍 How to Verify
Check if Vulnerable:
Check Admin Classic Bundle version via Composer: composer show pimcore/admin-ui-classic-bundle | grep versionCheck Version:
composer show pimcore/admin-ui-classic-bundle | grep versionVerify Fix Applied:
Verify version is 1.2.2 or higher and test 2FA enforcement for non-admin users📡 Detection & Monitoring
Log Indicators:
- Authentication logs showing successful login without 2FA completion for non-admin users
- Access to admin functions from non-admin user accounts
Network Indicators:
- Unusual authentication patterns from non-admin accounts
- Access to administrative endpoints without expected 2FA delays
SIEM Query:
source="pimcore" (event="authentication_success" AND NOT event="2fa_completed") AND user_role!="admin"🔗 References
- https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628
- https://github.com/pimcore/admin-ui-classic-bundle/pull/345
- https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg
- https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
- https://github.com/pimcore/admin-ui-classic-bundle/commit/e412b0597830ae564a604e2579eb40e76f7f0628
- https://github.com/pimcore/admin-ui-classic-bundle/pull/345
- https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-9wwg-r3c7-4vfg
- https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
