SQL Injection in pimcore/customer-data-framework

Root

Cause

The vulnerability resides in the inheritableSegments method of the Customer Data Framework (CDF) bundle for Pimcore [1]. Prior to version 3.3.10, the method directly concatenated user-supplied type and id parameters into a SQL query without proper sanitization or parameterization. Specifically, the query construction used sprintf to insert the type value into table name and column name positions, and the id value into the WHERE clause [4]. This allowed an attacker to inject arbitrary SQL syntax by providing crafted input for these parameters.

Attack

Vector

An attacker can exploit this vulnerability by sending a request to the endpoint that invokes inheritableSegments with malicious values for the type or id parameters [3]. No authentication is required to reach this endpoint, as it is exposed to unauthenticated users. The lack of input validation means that the attacker can break out of the intended query structure and inject additional SQL commands. For example, setting type to a value containing a single quote or SQL keyword would alter the query's logic.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL statements against the underlying database [1]. This can lead to unauthorized reading, modification, or deletion of data. In the context of the Customer Data Framework, this includes sensitive customer information, segmentation data, and potentially system-level data if the database user has elevated privileges. The attack could result in complete compromise of data confidentiality and integrity.

Mitigation

The issue was patched in CDF version 3.3.10, released on 2023-04-26 [3]. The fix, implemented in commit [4], replaced the vulnerable string interpolation with proper use of prepared statements and quoted identifiers. However, note that the open-source community version of the bundle has been archived and is EOL; users are encouraged to migrate to the enterprise edition for continued support [2]. For those unable to upgrade immediately, applying input validation and using parameterized queries can serve as temporary mitigations.