In the module “Amazon” (amazon) up to version 5.2.23 from Common Services for PrestaShop, a guest can access personal data.

Summary

  • CVE ID: CVE-2023-33777
  • Published at: 2023-07-13
  • Advisory source: PrestaShop
  • Platform: PrestaShop
  • Product: amazon
  • Impacted release: <= 5.2.23 (5.2.24 fixed the vulnerability)
  • Product author: Common Services
  • Weakness: CWE-359
  • Severity: medium (5.3)

Description

Due to a lack of permissions’s control, a guest can access personal data including an order’s secret from the module which can lead to leak of personal information from ps_customer table sush as name / surname and be used in others modules which protect access with this secret.

Be warned the module can expose others sensitives technicals information in another way, see “Other recommendations” below.

CVSS base metrics

  • Attack vector: network
  • Attack complexity: low
  • Privilege required: none
  • User interaction: none
  • Scope: unchanged
  • Confidentiality: low
  • Integrity: none
  • Availability: none

Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Possible malicious usage

  • Steal personal data

Patch from 17.1.3

diff --git a/functions/fbaorder.php b/functions/fbaorder.php
index 87ea4d2..6e0a4db 100644
--- a/functions/fbaorder.php
+++ b/functions/fbaorder.php
@@ -37,0 +38,4 @@ class AmazonFBAOrder extends AmazonFunction
+        if (!$this->functionAuthorization()) {
+            die('Wrong Token');
+        }
+
diff --git a/functions/orders.php b/functions/orders.php
index 0a0361f..4874d89 100644
--- a/functions/orders.php
+++ b/functions/orders.php
@@ -64,0 +65,4 @@ class AmazonListOrder extends AmazonFunction
+        if (!$this->functionAuthorization()) {
+            die('Wrong Token');
+        }
+
diff --git a/functions/orders/import_selection.php b/functions/orders/import_selection.php
index db86901..a7a88f7 100644
--- a/functions/orders/import_selection.php
+++ b/functions/orders/import_selection.php
@@ -14,0 +15,4 @@ class AmazonFunctionOrderImportSelection extends AmazonImportOrder
+        if (!$this->functionAuthorization()) {
+            die('Wrong Token');
+        }

Other recommendations

  • It’s recommended to upgrade to the latest version of the module amazon up to 5.2.24
  • You should restrict access to a given whitelist these paths : /modules/amazon/functions/ and /modules/amazon/support/

Timeline

Date Action
2023-03-21 Issue discovered after a security audit by Vitalyn
2023-03-21 Contact Author
2023-03-24 Author provide patch
2023-05-18 Request a CVE ID
2023-05-26 Received CVE ID
2023-07-13 Publish this security advisory