CVE-2024-36626

Executive Summary

CVE-2024-36626 identifies a NULL pointer dereference vulnerability in PrestaShop version 8.1.4, specifically within the math_round function located in Tools.php. This flaw can lead to a denial of service (DoS) condition when an attacker supplies specially crafted input that triggers the NULL dereference, potentially crashing the application. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code is available, and no official patch has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Vector: UNKNOWN
• Attack Vector (AV): UNKNOWN
• Attack Complexity (AC): UNKNOWN
• Privileges Required (PR): UNKNOWN
• User Interaction (UI): UNKNOWN
• Scope (S): UNKNOWN
• Confidentiality (C): UNKNOWN
• Integrity (I): UNKNOWN
• Availability (A): UNKNOWN
• EPSS Score: 0.0% (Low probability of exploitation in the wild)
• Threat Level: Low (due to lack of PoC, low EPSS, and no active exploitation reports)

Deep Dive & Mechanics

The vulnerability resides in the math_round function within classes/Tools.php of PrestaShop 8.1.4. A NULL pointer dereference occurs when the function receives an unexpected or malformed argument, causing the application to attempt to access memory at address 0x0. This typically results in a segmentation fault or unhandled exception, leading to a denial of service.

The math_round function is used for rounding numerical values, likely in price calculations or other numeric operations. An attacker could exploit this by sending a specially crafted HTTP request that passes a NULL or invalid value to a parameter that eventually reaches this function. Since PrestaShop is an e-commerce platform, such an attack could disrupt store operations, including checkout processes, product pricing displays, or administrative functions.

No official patch or advisory has been released by PrestaShop. The vendor has not acknowledged the vulnerability publicly, and no fix is available in the current stable release.

Vulnerable vs. Patched Code

Vulnerable Code (PrestaShop 8.1.4 - classes/Tools.php):

public static function math_round($value, $precision = 0, $mode = PHP_ROUND_HALF_UP)
{
    // No input validation for $value
    return round($value, $precision, $mode);
}

Patched Code (Hypothetical fix):

public static function math_round($value, $precision = 0, $mode = PHP_ROUND_HALF_UP)
{
    if ($value === null || !is_numeric($value)) {
        // Handle invalid input gracefully
        return 0;
    }
    return round($value, $precision, $mode);
}

The fix involves adding a null check and type validation before passing the value to the round() function. This prevents the NULL pointer dereference by ensuring that only valid numeric values are processed.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Since no public exploit code is available, a red team would need to craft a custom payload. The attack vector is likely through HTTP parameters that are passed to the math_round function. For example, an attacker could send a POST request to a vulnerable endpoint with a NULL value in a parameter that triggers the function.

Example Payload (Hypothetical):

POST /index.php?controller=product&id_product=1 HTTP/1.1
Host: target-prestashop.com
Content-Type: application/x-www-form-urlencoded

price=null

If the application passes the price parameter directly to math_round without validation, this could cause a crash.

Lab Setup:

1. Install PrestaShop 8.1.4 on a local server (e.g., using Docker or XAMPP).
2. Identify endpoints that use math_round (e.g., product price calculations, cart totals).
3. Send crafted requests with NULL or non-numeric values to trigger the vulnerability.
4. Monitor server logs and application behavior for crashes.

Blue Team (Defense & Detection)

Detection:

• Monitor application logs for PHP fatal errors related to Tools.php and math_round.
• Look for HTTP requests containing suspicious parameters (e.g., price=null, value=null).
• Use Web Application Firewall (WAF) rules to block requests with NULL or non-numeric values in critical parameters.

Mitigation:

• Apply input validation on all user-supplied data before passing to math_round.
• Implement a custom patch as shown in the "Vulnerable vs. Patched Code" section.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• Log Entries: PHP Fatal error: Uncaught TypeError: round(): Argument #1 ($num) must be of type int|float, null given in /path/to/prestashop/classes/Tools.php:XX
• HTTP Requests: POST requests with parameters containing null or empty values that are passed to price/quantity fields.
• Server Behavior: Intermittent 500 Internal Server Errors or application crashes during price calculations.

Detection Engineering

YARA Rule

rule CVE_2024_36626_NULL_Pointer_Dereference
{
    meta:
        description = "Detects NULL pointer dereference in PrestaShop math_round function"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-36626"
        hash = "d41d8cd98f00b204e9800998ecf8427e"

    strings:
        $php_error = "Argument #1 ($num) must be of type int|float, null given"
        $tools_php = "Tools.php"
        $math_round = "math_round"

    condition:
        $php_error or ($tools_php and $math_round)
}

Sigma Rule

title: CVE-2024-36626 PrestaShop NULL Pointer Dereference
id: c4e5f6a7-b8c9-0d1e-2f3a-4b5c6d7e8f90
status: experimental
description: Detects attempts to exploit NULL pointer dereference in PrestaShop math_round function
author: Valters IT
date: 2024-07-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36626
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'price=null'
            - 'value=null'
            - 'amount=null'
    condition: selection
falsepositives:
    - Legitimate use of 'null' string in parameters (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36626 PrestaShop NULL Pointer Dereference Attempt"; flow:to_server,established; content:"POST"; http_method; content:"price=null"; http_client_body; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply input validation to all parameters that are passed to the math_round function. Ensure that only numeric values are accepted.
2. Custom Patch: Modify classes/Tools.php to include a null check and type validation before calling round().
3. WAF Rules: Deploy Web Application Firewall rules to block requests containing NULL or non-numeric values in critical parameters.
4. Monitor: Continuously monitor application logs for PHP fatal errors related to Tools.php.
5. Vendor Update: Watch for official patches from PrestaShop and apply them as soon as they are released.
6. Backup: Maintain regular backups of the application and database to facilitate recovery in case of a DoS attack.

Valters IT - DevSecOps & Cyber Threat Intelligence