In the module “SocialFeed - Photos & Video/Reels using Instagram API” (boninstagramcarousel) up to version 6.0.0 from Bon Presta for PrestaShop, an anonymous user can perform a Server-Side Request Forgery (SSRF).
- CVE ID: CVE-2023-43982
- Published at: 2023-11-02
- Platform: PrestaShop
- Product: boninstagramcarousel
- Impacted release: >= 5.2.1 & <= 6.0.0 (7.0.0 fixed the vulnerability)
- Product author: Bon Presta
- Weakness: CWE-918
- Severity: critical (9.1)
An improper validation of the
url parameter in the
insta_parser.php script can be executed via a trivial HTTP call to forge Server-Side Request.
This vulnerability can be exploited to initiate an HTTP request and get the return, for instance, use the vulnerable website as a proxy to attack other websites, exfiltrate data in files under IP restriction or perform a path traversal attack.
Since it’s a design issue, we cannot provide a patch, you should consider upgrading or deleting the module.
CVSS base metrics
- Attack vector: network
- Attack complexity: low
- Privilege required: none
- User interaction: none
- Scope: unchanged
- Confidentiality: high
- Integrity: high
- Availability: none
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Possible malicious usage
- Attack other websites via the vulnerability
- Bypass WAF/.htaccess restrictions
- Perform a path traversal attack using the wrapper : file://
- It’s recommended to upgrade the module to its latest version
- You should restrict access to modules/boninstagramcarousell/controllers/back/ to a given whitelist
- Activate OWASP 931’s rules on your WAF (Web application firewall), be warned that you will probably break your frontoffice and your backoffice and you will need to pre-configure some bypasses against these sets of rules.
|2023-08-04||Issue discovered during a code review by Ambris Informatique and TouchWeb|
|2023-08-04||Contact PrestaShop Addons security Team to confirm version scope by author|
|2023-08-21||PrestaShop Addons security Team confirm versions scope by author|
|2023-09-21||Request a CVE ID|
|2023-09-28||Received CVE ID|
|2023-11-02||Publish this security advisory|
DISCLAIMER: The French Association Friends Of Presta (FOP) acts as an intermediary to help hosting this advisory. While we strive to ensure the information and advice provided are accurate, FOP cannot be held liable for any consequences arising from reported vulnerabilities or any subsequent actions taken.