Pimcore CustomReports Authorization Bypass via Inconsistent Access Control (CVE-2024-45704)

Vulnerability Overview Vulnerability Name: CustomReports Share Bypass CVE ID: CVE-2024-45704 Severity: High Affected Versions: <=11.5.16 Fixed Versions: 11.5.17 (LTS), 12.3.6 Description: CustomReports uses an inconsistent authorization mechanism between the report list endpoint and the report details endpoint. The report list filter filters reports based on report sharing rules, whereas the report details endpoint only checks generic permissions (such as or ). Consequently, a low-privilege user can directly read a specific report by name, even if that report is not in the user's visible report list, despite not having explicit access rights to it. Root Cause: The report list endpoint filters reports via . The report details endpoint only checks generic permissions and then loads the report directly by name. Impact: An attacker can read sensitive report metadata without authorization, including: Report name Grouping information Display and icon metadata Data source configuration Column configuration Sharing settings Scope of Impact Prerequisites: - The attacker is an authenticated backend user. - The attacker possesses the permission. - The target report is not globally shared, nor is it shared with the user or their role. PoC Code: Remediation 1. Add Object-Level Sharing Check: Add an object-level sharing check in that is equivalent to . 2. Centralize Authorization Logic: Centralize the authorization logic into a single "can current user access this report" function, to be reused by endpoints such as , , , , and . 3. Return 403 Error: Return a 403 error for unauthorized report access requests. 4. Add Regression Tests: Ensure that users with the permission but without report sharing access cannot retrieve report details. Reproduction Steps 1. Create a low-privilege user named and assign the permission. 2. Create a report named , setting and . 3. Request the list of visible reports as the user, confirming that is not included in the list. 4. Call directly as the same user. 5. Verify that the response still contains the report configuration. Reproduction Results This indicates that the current user cannot see the report in the visible report list, yet the same user can still directly retrieve the report configuration. This confirms that the sharing bypass issue is exploitable in practice. Security Impact Unauthorized disclosure of report configurations Disclosure of sharing scope and internal report structures Potential leakage of data source and query organization details Useful reconnaissance for subsequent unauthorized execution or export paths Fix Recommendations 1. Add an object-level sharing check in equivalent to . 2. Centralize the authorization logic into a single "can current user access this report" function, to be reused by endpoints such as , , , , and . 3. Return a 403 error for unauthorized report access requests. 4. Add regression tests to ensure that users with the permission but without report sharing access cannot retrieve report details.

Goal Reached Thanks to every supporter — we hit 100%!

Pimcore CustomReports Authorization Bypass via Inconsistent Access Control (CVE-2024-45704)

More from this source