Code execution via hijacked module upgrade archive
Published Aug 12, 2024 · Updated Oct 9, 2024
Code injection in PrestaShop 8.1.7 and earlier allows attackers to execute arbitrary server code through a tampered module upgrade. The module upgrade action accepts a source URL, downloads its ZIP through a source handler, and installs attacker-modified module code without authenticating the archive's origin. Multiple parties dispute the unauthenticated framing because exploitation requires hijacking an administrator's upgrade request for an installed outdated module.
Summary
What happened
Code injection in PrestaShop 8.1.7 and earlier allows attackers to execute arbitrary server code through a tampered module upgrade. The module upgrade action accepts a source URL, downloads its ZIP through a source handler, and installs attacker-modified module code without authenticating the archive's origin. Multiple parties dispute the unauthenticated framing because exploitation requires hijacking an administrator's upgrade request for an installed outdated module.
The record
- CVE
- CVE-2024-41651
- Published
- Aug 12, 2024
- Updated
- Oct 9, 2024
- Vendor
- PrestaShop
- Product
- PrestaShop
- Classifications
- CWE-918, CWE-94, T1195.002
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Aug 12, 2024CVE publishedPublication date reported by the CVE source.
- Oct 9, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0 <=8.1.7
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Blind SSRF to RCE Exploit - PrestaShop 8.1.7proof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo