CVE-2022-45447

# CVE-2022-45447 — Threat Intelligence Report

---

## Executive Summary

CVE-2022-45447 is a directory traversal vulnerability in the M4 PDF plugin (version 3.2.3 and earlier) for Prestashop e-commerce sites. The flaw resides in the `f` parameter of the `/m4pdf/pdf.php` resource, which fails to properly validate user-supplied relative paths, allowing an unauthenticated attacker to read arbitrary files from the server's filesystem. Successful exploitation results in the disclosure of sensitive information, such as the `/etc/passwd` file, potentially exposing usernames, service accounts, and system topology. The vulnerability carries a CVSS score of 6.5 and is rated as medium severity, yet its trivial exploitation and direct information-disclosure impact make it a credible threat to affected installations.

---

## Technical Analysis

The vulnerability is a classic **absolute path traversal / directory traversal** flaw (CWE-22). The M4 PDF plugin exposes a PHP endpoint at the resource path `/m4pdf/pdf.php`. This endpoint likely invokes a PDF generation or file-serving function that retrieves a file based on a request parameter named `f`.

According to the NVD description, the `f` parameter expects a **relative path** to a file (e.g., a PDF template or resource). However, the application fails to sanitize this parameter for traversal sequences such as `../`. When an attacker submits a path traversal payload like `../../../../etc/passwd`, the application resolves the path relative to a base directory (likely the plugin's or server's document root) without enforcing a containment boundary. The server then reads the file and returns its contents in the HTTP response.

Key technical details:

- **Attack surface:** The `pdf.php` resource is directly reachable over HTTP without authentication (based on the NVD description indicating an attacker can exploit it without mention of authentication requirements).
- **Parameter:** `f`
- **Vulnerability class:** Directory traversal — the parameter is concatenated into a file path operation without validation of `../` sequences or canonicalization checks.
- **Impact of missing checks:** The absence of proper input validation (rejecting traversal sequences, enforcing a whitelist, or using safe file-access APIs) makes the endpoint susceptible to reading any file on the filesystem that the web server process (typically `www-data` or `apache`) has read access to.

**Specific code-level details (inferred from vulnerability class):**
The underlying PHP code likely performs an operation similar to `file_get_contents($base_dir . $_GET['f'])` or `readfile(...)`. Because the code does not normalize the path or confine it to the plugin's directory, the traversal payload escapes the base directory. No other function names, parameters, or implementation details are disclosed in the NVD description; therefore, this inference is provided at the class level.

---

## Exploitation Scenarios

Based strictly on the NVD description and the directory traversal class mechanics, the attack chain is as follows:

**1. Reconnaissance / Target Identification**
The attacker identifies Prestashop sites running the M4 PDF plugin. This can be achieved via:
- Scanning for the known resource path `/m4pdf/pdf.php` (e.g., via web crawl or directory brute-force).
- Fuzzing for the plugin directory across target domains.
- Using Shodan or Google dorks to locate exposed instances (see Shodan Dorks in Metadata).

**2. Triggering the Flaw**
The attacker sends an HTTP GET request to the vulnerable endpoint:

GET /m4pdf/pdf.php?f=../../../../../../etc/passwd HTTP/1.1 Host: [target]

The `f` parameter contains a traversal sequence that navigates up the directory tree from the intended base directory to the root filesystem, then into `/etc/passwd`.

**3. Payload Execution (Read Operation)**
The server-side script processes the `f` parameter without sanitization. The path resolves to `/etc/passwd`, which the web server process reads and includes in the HTTP response body (typically as plain text or embedded in a PDF generation output that leaks the content).

**4. Post-Exploitation Impact**
- **Information disclosure:** The attacker obtains the contents of `/etc/passwd`, revealing system usernames (root, daemon, www-data, etc.).
- **Lateral expansion:** Usernames can be leveraged for targeted credential-stuffing attempts or SSH brute-force attacks.
- **Further file reads:** The attacker can repeatedly traverse to read other sensitive files such as:
  - Application configuration files (e.g., `config/settings.inc.php` in Prestashop), potentially exposing database credentials.
  - Environment variables, `.env` files, or backup archives.
  - Log files containing session tokens or API keys.

**Note:** No public PoC is confirmed, so this attack chain is inferred from the vulnerability class and the explicitly provided parameter and resource path. The traversal mechanism is standard, but the exact response formatting (PDF output vs. raw text) is not disclosed.

---

## Impact Assessment

- **CVSS Score:** 6.5 (Medium). The vector indicates an unauthenticated network attack with no user interaction and high confidentiality impact. The attack requires no privileges and no special conditions.
- **Business Impact:**
  - **Confidentiality breach:** Direct exposure of sensitive server files leads to credential leakage, system reconnaissance, and potential subsequent compromise.
  - **Compliance risk:** If customer data, payment processing details, or access credentials are exfiltrated, the organization may face GDPR, PCI-DSS, or industry-specific violations with financial penalties.
- **Affected Systems:** Any Prestashop deployment running the M4 PDF plugin version 3.2.3 or earlier.
- **Blast Radius:** The plugin is used by Prestashop (a widely adopted e-commerce platform) store owners for PDF invoice generation. The blast radius is limited to the webserver's filesystem, but given that Prestashop stores database credentials in configuration files, full database compromise is plausible if those files are readable.
- **Exploitation Likelihood:** With a disclosed parameter and resource path, exploitation is trivial (no authentication, no complexity). EPSS score of 0.00713 (50.4th percentile) indicates moderate real-world exploitation probability, though lack of public PoC may limit active campaigns.

---

## Detection Guidance

### Sigma Rule

```yaml
title: Directory Traversal Attempt Against M4 PDF Plugin (CVE-2022-45447)
id: 7f3a3c2e-2b8c-4f6a-9e4d-8c4f6a9e4d8f
status: experimental
description: Detects HTTP requests to /m4pdf/pdf.php with f parameter containing traversal sequences.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45447
tags:
    - attack.initial_access
    - attack.t1190
    - attack.collection
    - attack.t1005
    - cve.2022-45447
logsource:
    category: webserver
    product: apache
    definition: 'Requires access logs or a reverse proxy log capturing full request URIs.'
detection:
    selection:
        cs-method: GET
        cs-uri-path|contains: '/m4pdf/pdf.php'
        cs-uri-query|contains|all:
            - 'f='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths with '..' if the plugin intentionally uses such patterns (unlikely).
level: high

YARA Rule

rule cve_2022_45447_m4pdf_traversal
{
    meta:
        author = "Valtersit TR"
        description = "Detects directory traversal signatures in HTTP requests targeting M4 PDF plugin for Prestashop"
        date = "2025-01-10"
        cve = "CVE-2022-45447"
        severity = "medium"
    strings:
        $path = "/m4pdf/pdf.php" ascii nocase
        $f_param = "f=" ascii nocase
        $traversal1 = "../" ascii
        $traversal2 = "..%2f" ascii nocase
        $traversal3 = "..%2F" ascii nocase
        $etc_passwd = "/etc/passwd" ascii nocase
    condition:
        ($path and $f_param) and
        (1 of ($traversal*) or $etc_passwd)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"ET EXPLOIT Prestashop M4 PDF Plugin Directory Traversal (CVE-2022-45447)";
    flow:established,to_server;
    http.method; content:"GET";
    http.uri; content:"/m4pdf/pdf.php";
    http.uri; content:"f=";
    http.uri; content:"../";
    classtype:attempted-user;
    sid:2024544701;
    rev:1;
    metadata:created_at 2025_01_10, updated_at 2025_01_10;
)

Elastic Detection

any where
  event.category == "web" and
  url.path == "/m4pdf/pdf.php" and
  url.query : "*f=*..%2f*" or
  url.query : "*f=*../*" and
  url.full : "*pdf.php?f=*"

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/m4pdf/pdf.php%")
| where like(uri_query, "%f=%")
| where like(uri_query, "%../%") OR like(uri_query, "%..%2f%")
| table _time, src_ip, dest_host, uri_path, uri_query, status
| sort - _time

Wazuh OSSEC Rule

<group name="web-attacks,">
  <rule id="100454" level="14">
    <decoded_as>web</decoded_as>
    <description>Prestashop M4 PDF Plugin directory traversal attempt (CVE-2022-45447)</description>
    <field name="url">/m4pdf/pdf.php</field>
    <field name="parameters" type="pcre2">\bf=\b[^\s]*\.\./</field>
    <group>attack.t1190,directory_traversal,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The CNA has stated a patch exists, but it has not been independently verified. The exact patched version number is not disclosed in the available data.

Immediate Mitigations (until patch is applied):

1. Disable or remove the M4 PDF plugin if not absolutely necessary for business operations.
2. Apply a Web Application Firewall (WAF) rule to block HTTP requests to /m4pdf/pdf.php that contain ../ or URL-encoded ..%2f sequences in the f parameter.
3. Restrict network access to the plugin directory via .htaccess or server configuration to allow only internal IPs or trusted admin networks.
4. Temporarily edit the plugin's PHP file to sanitize the f parameter using basename() or a whitelist, but verify this does not break plugin core functionality.

Patch/Upgrade Steps:

1. Monitor the Prestashop addons marketplace or the CNA's advisory (since the specific advisory URL is not provided) for the patched version of M4 PDF.
2. Backup the current installation and database.
3. Upgrade the M4 PDF plugin to the latest available version > 3.2.3.
4. After upgrade, re-test the /m4pdf/pdf.php endpoint with traversal payloads to confirm the fix.

Long-Term Hardening:

1. Centralize web server logs and implement SIEM correlation rules (as per the detection guidance above) to identify traversal attempts early.
2. Enforce least-privilege on the web server process — ensure it cannot read sensitive files outside its document root (e.g., via OS-level file permissions or containerization).
3. Conduct regular vulnerability scanning of Prestashop instances and subscribe to CVE feeds for e-commerce plugins.
4. Apply a Content Security Policy (CSP) and serve sensitive files only through authenticated, server-side-controlled endpoints to reduce risk of future traversal vectors.

References

1. NVD Entry (Official): https://nvd.nist.gov/vuln/detail/CVE-2022-45447
2. CNA Advisory (Patch Claim): Referenced by the CNA in the CVE record — specific URL not provided in the data; monitor Prestashop Addons marketplace for M4 PDF plugin release notes.
3. Shodan Search (for asset discovery): Use the dorks provided in the Metadata section to identify exposed instances.
4. CISA KEV: Not applicable — this CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public exploit code or confirmed in-the-wild campaigns have been identified at the time of writing. The EPSS score (0.00713) and lack of KEV listing suggest this threat has not been widely weaponized, but the low attack complexity and clear disclosure of the vulnerable parameter make active exploitation a plausible near-term development.