[CVE-2023-30839] SQL filter bypass leading to arbitrary write requests using SQL Manager [DEBATE RUNNING ABOUT SCORING FROM PS CORE]

SQL filtering vulnerability, a BO user can write, update and delete in the database, even without having specific rights.

Summary

CVE ID: CVE-2023-30839
Published at: 2022-05-03
Advisory source: PrestaShop
Platform: PrestaShop
Product: PrestaShop
Impacted release: >= 8.0.0 < 8.0.3 and < 1.7.8.8 (Patched versions 8.0.4 and 1.7.8.9)
Weakness: CWE-22
Severity: high (8.8) (source NVD)*

Description

It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.

CVSS base metrics

Attack vector: network
Attack complexity: low
Privilege required: low
User interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (source NVD)*

According to Friends of Presta, the severity is lower than 8.8. The vunlerability is only in backoffice, we consider Privilege required sould be “high”.

Possible malicious usage

Obtain database access
Extract sensitive data, such as tokens or private keys stored in config files
Extract other private data, such as log files or exports

Patch

--- a/classes/db/Db.php
+++ b/classes/db/Db.php
@@ -603,11 +603,7 @@ public function executeS($sql, $array = true, $use_cache = true)
 
         // This method must be used only with queries which display results
         if (!preg_match('#^\s*\(?\s*(select|show|explain|describe|desc)\s#i', $sql)) {
-            if (defined('_PS_MODE_DEV_') && _PS_MODE_DEV_) {
-                throw new PrestaShopDatabaseException('Db->executeS() must be used only with select, show, explain or describe queries');
-            }
-
-            return $this->execute($sql, $use_cache);
+            throw new PrestaShopDatabaseException('Db->executeS() must be used only with select, show, explain or describe queries');
         }
 
         $this->result = $this->query($sql);

Other recommendations

It’s recommended to upgrade to the latest version of the PrestaShop 1.7.8.9 or 8.0.4.