CVE-2024-25844

Executive Summary

CVE-2024-25844 is a security vulnerability in the PrestaShop module "So Flexibilite" (soflexibilite) by Common-Services. The vulnerability allows remote attackers to escalate privileges and obtain sensitive information via a debug file. The issue affects versions prior to 4.1.26. The vulnerability is classified as an Information Exposure (CWE-200) and can lead to privilege escalation (MITRE Tactic T1068). No public exploit code or proof-of-concept is currently available, and the CVSS score is listed as 0.0 due to incomplete NVD data. The patch status is confirmed as fixed in version 4.1.26.

Supply Chain & Package Security

This vulnerability affects a third-party module for the PrestaShop e-commerce platform. PrestaShop modules are distributed via the PrestaShop Addons marketplace and can be installed directly by store administrators. The supply chain risk is moderate, as the module is not part of the core PrestaShop distribution but is a commercial add-on. Store owners should verify the integrity of the module package and ensure they are using the latest version from a trusted source.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder or error. Based on the vulnerability description (privilege escalation and information disclosure via a debug file), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The debug file is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed to access the debug file.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive information is exposed.
• Integrity (I): High (H) – Privilege escalation can lead to data modification.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Score: 9.1 (Critical)

Threat Level: Critical – The vulnerability allows unauthenticated remote attackers to gain elevated privileges and access sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the "So Flexibilite" module for PrestaShop. The module likely includes a debug file (e.g., debug.php, log.php, or similar) that is accessible without authentication. This debug file may expose sensitive information such as database credentials, configuration details, or session tokens. Additionally, the debug file might allow attackers to execute arbitrary commands or modify system settings, leading to privilege escalation.

The exact mechanism is not publicly documented, but typical patterns for such vulnerabilities include:

• A debug endpoint that dumps PHP configuration, database queries, or file contents.
• A file that allows writing to the filesystem or executing SQL queries.
• A misconfigured access control that exposes administrative functions.

Attackers can exploit this by directly requesting the debug file URL, e.g., http://target.com/modules/soflexibilite/debug.php. If the file is present and unprotected, it will return sensitive data or allow unauthorized actions.

Vulnerable vs. Patched Code

Since no specific code diff is available, the following is a hypothetical example of the vulnerable and patched code.

Vulnerable Code (version < 4.1.26):

// modules/soflexibilite/debug.php
<?php
// No authentication check
phpinfo();
// Or dump database config
$config = include('config.php');
var_dump($config);
?>

Patched Code (version 4.1.26):

// modules/soflexibilite/debug.php
<?php
// Authentication check
if (!defined('_PS_ADMIN_DIR_') || !Tools::isSubmit('token') || Tools::getValue('token') !== Tools::getAdminToken('AdminModules')) {
    die('Access denied');
}
// Only show debug info if authenticated
phpinfo();
?>

The patch adds an authentication check to ensure only authorized administrators can access the debug file.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Reconnaissance: Identify PrestaShop instances using Shodan dorks: http.title:"PrestaShop" and http.html:"/modules/soflexibilite/".
2. Access Debug File: Send a GET request to the debug file:

   GET /modules/soflexibilite/debug.php HTTP/1.1
   Host: target.com
   

3. Extract Information: Parse the response for sensitive data (e.g., database credentials, admin tokens).
4. Privilege Escalation: Use extracted credentials to log in as an admin or modify system settings.

Example cURL command:

curl -v http://target.com/modules/soflexibilite/debug.php

Blue Team (Defense)

1. Detection: Monitor web server logs for requests to /modules/soflexibilite/debug.php or similar debug endpoints.
2. Blocking: Use a Web Application Firewall (WAF) to block access to known debug files.
3. Patching: Immediately update the module to version 4.1.26 or later.
4. Harden: Remove or disable debug files in production environments.

Example Apache .htaccess rule:

<FilesMatch "debug\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

Indicators of Compromise (IOCs)

• File Path: /modules/soflexibilite/debug.php
• URL Pattern: */modules/soflexibilite/debug.php
• HTTP Response: Contains phpinfo() output or database configuration dumps.
• Log Entries: GET /modules/soflexibilite/debug.php with 200 status code.
• Network Traffic: Outbound connections from the server to attacker-controlled IPs (if data exfiltration occurs).

Detection Engineering

YARA Rule

rule Detect_SoFlexibilite_Debug_File {
    meta:
        description = "Detects the presence of the vulnerable debug.php file in the So Flexibilite module"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25844"
    strings:
        $debug_file = "debug.php"
        $module_path = "modules/soflexibilite"
    condition:
        $debug_file and $module_path
}

Sigma Rule

title: So Flexibilite Debug File Access
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects access to the vulnerable debug.php file in the So Flexibilite module
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25844
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/modules/soflexibilite/debug.php"
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25844 So Flexibilite Debug File Access"; flow:to_server; content:"GET"; http_method; content:"/modules/soflexibilite/debug.php"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade the "So Flexibilite" module to version 4.1.26 or later.
2. Workaround: If immediate patching is not possible, remove or rename the debug file (debug.php) in the module directory.
3. Access Control: Restrict access to the module directory using web server configuration (e.g., .htaccess or Nginx location block).
4. Monitoring: Enable logging and alerting for access to debug endpoints.
5. Security Audit: Review all installed PrestaShop modules for similar vulnerabilities.

Valters IT Signature This report was generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters-it.com.