CVE-2024-41651

Executive Summary

CVE-2024-41651 is a disputed vulnerability in PrestaShop versions 8.1.7 and earlier, involving the module upgrade functionality. The core claim is that a remote attacker can execute arbitrary code via this feature. However, multiple parties dispute this, arguing that exploitation requires an attacker to hijack network requests made by an admin user—who, by design, is allowed to change server code. This dispute significantly lowers the practical risk, as the attack vector depends on a privileged user performing actions under attacker-controlled network conditions. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), indicating a code injection risk. No public proof-of-concept (PoC) or exploit code is available, and the EPSS score is 0.0%, suggesting no active exploitation in the wild. The vendor has not released an official patch, and the status remains UNKNOWN/UNPATCHED.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core PrestaShop e-commerce platform issue, affecting the module upgrade mechanism. The disputed nature and requirement for admin-level network hijacking reduce the supply chain risk, but organizations should monitor for official patches or workarounds from PrestaShop.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
• Base Score: 6.6 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required beyond network hijacking.
• Privileges Required (PR): High (H) – Attacker needs admin-level privileges or ability to hijack admin network requests.
• User Interaction (UI): Required (R) – Admin user must perform an action (e.g., upgrade a module) under attacker-controlled network conditions.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: Medium. The requirement for admin-level network hijacking significantly reduces exploitability, but the potential impact is severe if successfully exploited.

Deep Dive & Mechanics

The vulnerability resides in PrestaShop's module upgrade functionality, which allows administrators to update modules from remote repositories. The disputed claim is that an attacker can inject arbitrary code during this process. The attack scenario involves:

1. Network Hijacking: An attacker must intercept or manipulate network requests made by an admin user during a module upgrade. This could be achieved via Man-in-the-Middle (MitM) attacks, DNS spoofing, or compromising the update server.
2. Code Injection: By controlling the response from the update server, the attacker can inject malicious code into the module package, which is then executed on the server.
3. Privilege Escalation: Since the admin user has permissions to modify server code, the injected code runs with high privileges, leading to full system compromise.

The dispute centers on whether this is a vulnerability in PrestaShop or a general network security issue. The vendor and some researchers argue that the admin user is already trusted to change code, and the attack requires compromising the network layer, which is outside PrestaShop's control. However, others argue that PrestaShop should validate the integrity of downloaded modules (e.g., via cryptographic signatures) to prevent such attacks.

Vulnerable vs. Patched Code

No official patch is available. The vulnerable code is in the module upgrade functionality, which does not verify the integrity of downloaded packages. A hypothetical patched version would include:

• Vulnerable Code (Conceptual):

  // No integrity check
  $modulePackage = file_get_contents($updateUrl);
  // Directly extract and install
  $zip = new ZipArchive();
  $zip->open($modulePackage);
  $zip->extractTo($installPath);
  

• Patched Code (Conceptual):

  // Verify integrity with checksum
  $expectedHash = getExpectedHash($moduleName, $version);
  $modulePackage = file_get_contents($updateUrl);
  $actualHash = hash('sha256', $modulePackage);
  if ($actualHash !== $expectedHash) {
      throw new Exception('Module integrity check failed');
  }
  // Proceed with installation
  $zip = new ZipArchive();
  $zip->open($modulePackage);
  $zip->extractTo($installPath);
  

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a PrestaShop instance (v8.1.7 or earlier) with admin credentials.
• Ability to perform a Man-in-the-Middle (MitM) attack on the admin's network (e.g., using ARP spoofing, rogue Wi-Fi, or compromised DNS).

Steps:

1. Set up MitM: Use a tool like mitmproxy or Bettercap to intercept HTTP/HTTPS traffic from the admin's browser.
2. Identify Module Upgrade Request: Monitor for requests to PrestaShop's update server (e.g., api.prestashop.com or custom URLs).
3. Craft Malicious Payload: Create a ZIP file containing a malicious module with arbitrary PHP code (e.g., a web shell).
4. Intercept and Replace: When the admin triggers a module upgrade, intercept the response from the update server and replace it with the malicious ZIP file.
5. Execute: The admin's action will install the malicious module, executing the injected code on the server.

Example Payload (malicious_module.php):

<?php
system($_GET['cmd']);
?>

Note: This attack requires the admin to initiate a module upgrade while under MitM conditions. No public exploit code is available.

Blue Team

Detection:

• Monitor for unusual network traffic patterns, especially during module upgrades.
• Use network monitoring tools to detect MitM attacks (e.g., ARP spoofing detection).
• Implement integrity checks for all downloaded modules (e.g., using checksums from a trusted source).

Prevention:

• Enforce HTTPS with certificate pinning for all update communications.
• Use a VPN or secure network for admin operations.
• Restrict admin access to trusted IPs and networks.
• Implement a Web Application Firewall (WAF) to detect and block malicious payloads.

Response:

• If exploitation is suspected, immediately revoke admin credentials and isolate the affected server.
• Conduct a forensic analysis to identify the injected code and assess the impact.
• Restore from a known good backup.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual DNS requests to suspicious domains during module upgrades.
  • HTTP responses with unexpected content (e.g., ZIP files with mismatched checksums).
  • ARP spoofing alerts on the local network.

• File IOCs:

  • Unexpected PHP files in the modules directory (e.g., /modules/malicious_module/).
  • Modified core files (e.g., /config/defines.inc.php).
  • Presence of web shells (e.g., cmd.php, shell.php).

• Behavioral IOCs:

  • Unusual outbound connections from the web server.
  • Unexpected system commands executed via PHP (e.g., system(), exec()).
  • Admin account activity during unusual hours.

Detection Engineering

YARA Rule

rule CVE_2024_41651_PrestaShop_Module_Upgrade {
    meta:
        description = "Detects malicious module packages exploiting CVE-2024-41651"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-41651"
    strings:
        $php_code = /<\?php/i
        $zip_header = { 50 4B 03 04 }  // ZIP file header
        $suspicious_func = /system|exec|shell_exec|passthru|eval/i
    condition:
        $zip_header at 0 and $php_code and #suspicious_func > 0
}

Sigma Rule

title: PrestaShop Module Upgrade Network Hijack
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential MitM attacks during PrestaShop module upgrades
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 443
        http.host: "api.prestashop.com"
        http.response_body_length: ">100000"
    condition: selection
falsepositives:
    - Legitimate large module updates
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-41651 PrestaShop Module Upgrade Hijack"; flow:to_server,established; content:"api.prestashop.com"; http_host; pcre:"/\.zip$/Ui"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict admin access to trusted networks only (e.g., VPN).
   • Enforce HTTPS with certificate pinning for all update communications.
   • Monitor network traffic for MitM indicators during admin sessions.

2. Long-term Fixes:

   • Apply official patches from PrestaShop when available.
   • Implement module integrity verification (e.g., checksums) in custom deployments.
   • Use a Web Application Firewall (WAF) to filter malicious payloads.

3. Workarounds:

   • Disable automatic module upgrades and perform manual updates from trusted sources.
   • Use a staging environment to test module upgrades before applying to production.

4. Monitoring:

   • Enable detailed logging for all admin actions.
   • Set up alerts for unusual file modifications in the modules directory.

Valters IT – DevSecOps & Cyber Threat Intelligence Report