[CVE-2023-39528] Reading a file through path traversal & Remote Code Execution via unsafe deserialization

Initialy flagged as path traversal with a medium severity, the work of Friends Of Presta Security team proven the ability to use this vulnerability to implicity deserialize a malicious load (critical severity).

Summary

CVE ID: CVE-2023-39528
Published at: 2023-08-07
Advisory source: PrestaShop
Platform: PrestaShop
Product: PrestaShop
Impacted release: <= 8.1.0 (Patched versions 8.1.1)
Weakness: CWE-22 and CWE-502
Severity: critical (9.1)

Description

displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured.

Moreover, any wrapper like https, ftp, phar, … can be exploited to forge a SSRF (server side request forgery). The ability to use phar:// can be exploited to forge an unserialization as proven in our security research advisory “Exploring the perils of implicit deserialization of a phar in PrestaShop (part 2)”

CVSS base metrics

Attack vector: network
Attack complexity: low
Privilege required: high
User interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Possible malicious usage

Mailicious usage in PrestaShop via commons libraries are :

remote code execution (RCE) to put a webshell
Server Side Request Forgery (SSRF) to agress other website with a clean IP,
File Deletion (FD) to remove an htaccess and expose logs or sensitive data,
File Writer (WF) to put a webshell
Files read reader (RF) to read sensitive data like mysql password,
SQL injections (SQLi),
Technical data leaks (Info).

Patch

--- a/controllers/admin/AdminTranslationsController.php
+++ b/controllers/admin/AdminTranslationsController.php
@@ -3296,7 +3296,7 @@ public static function getEmailHTML($email)
             $email_file = _PS_ROOT_DIR_ . $email;
         }
 
-        if (file_exists($email_file)) {
+        if (strpos(realpath($email_file), _PS_ROOT_DIR_) === 0 && file_exists($email_file)) {
             $email_html = file_get_contents($email_file);
         } else {
             $email_html = '';

Other recommendations

Phar wrapper cannot be disabled via a php.ini settings.

As a developer:

A strict validation of input data is absolutely essential !
Use basename() PHP method to prevent path traversal getimagesize(basename($_GET['param'])) and unwanted use of wrapper such as phar://
Use GD library to remove dummy serialized data on an image.

As an adminsys

Set your firewall with OWASP rules to filter “phar://”