Reflected Cross-Site Scripting in PrestaShop Faceted Search Filter Templates

Skrevet den af i PrestaShop Faceted Search

The Faceted Search module echoes the per-language url_name value submitted in the back-office filter-template form back into an error message without escaping when the value is not a valid URL. An attacker who can get a logged-in back-office user to submit a crafted url_name obtains arbitrary JavaScript execution in the context of the shop’s admin panel.

This vulnerability affects the following application versions:

  • PrestaShop 1.7.6.0 RC 1
  • PrestaShop 1.7.6.0-RC.1
  • PrestaShop Faceted Search 3.0.1
  • PrestaShop Faceted Search 3.0.2
  • PrestaShop Faceted Search 3.0.3
  • PrestaShop Faceted Search 3.0.4
  • PrestaShop Faceted Search 3.0.5
  • PrestaShop Faceted Search 3.2.0
  • PrestaShop Faceted Search 3.2.1
  • PrestaShop Faceted Search 3.3.0
  • PrestaShop Faceted Search 3.4.0
  • PrestaShop Faceted Search 3.4.1

PHP Object Injection in faceted search cache allows unauthenticated RCE

Skrevet den af i PrestaShop Faceted Search

A PHP Object Injection vulnerability affects the PrestaShop module ps_facetedsearch.

The module rebuilds the selected search filters from the request URL. The value of a slider filter (price or weight) is taken from the URL without sufficient validation, then stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize().

By crafting that value, an attacker can smuggle a malicious serialized PHP object into the cache. When it is deserialized, a gadget chain writes an arbitrary PHP file inside the module directory, which is then used as a webshell to run commands on the server.

This vulnerability affects the following application versions:

  • PrestaShop 1.7.6.0
  • PrestaShop 1.7.6.0 RC 1
  • PrestaShop 1.7.6.0 RC 2
  • PrestaShop 1.7.6.0-RC.1
  • PrestaShop 1.7.6.0-RC.2
  • PrestaShop 1.7.6.1
  • PrestaShop 1.7.6.2
  • PrestaShop 1.7.6.3
  • PrestaShop 1.7.6.4
  • PrestaShop 1.7.6.4 1
  • PrestaShop 1.7.6.5
  • PrestaShop 1.7.6.5 1
  • PrestaShop 1.7.6.6
  • PrestaShop 1.7.6.7
  • PrestaShop 1.7.6.8
  • PrestaShop 1.7.6.9
  • PrestaShop 1.7.7.0
  • PrestaShop 1.7.7.0 beta 1
  • PrestaShop 1.7.7.0 beta 2
  • PrestaShop 1.7.7.0 RC 1
  • PrestaShop 1.7.7.0-beta.1
  • PrestaShop 1.7.7.0-beta.2
  • PrestaShop 1.7.7.0-RC.1
  • PrestaShop 1.7.7.1
  • PrestaShop 1.7.7.2
  • PrestaShop 1.7.7.3
  • PrestaShop 1.7.7.4
  • PrestaShop 1.7.7.5
  • PrestaShop 1.7.7.6
  • PrestaShop 1.7.7.7
  • PrestaShop 1.7.7.8
  • PrestaShop 1.7.7.8 1
  • PrestaShop 1.7.8.0
  • PrestaShop 1.7.8.0 beta 1
  • PrestaShop 1.7.8.0 1
  • PrestaShop 1.7.8.0 RC 1
  • PrestaShop 1.7.8.0-beta.1
  • PrestaShop 1.7.8.0-RC.1
  • PrestaShop 1.7.8.1
  • PrestaShop 1.7.8.2
  • PrestaShop 1.7.8.2 1
  • PrestaShop 1.7.8.4
  • PrestaShop 1.7.8.5
  • PrestaShop 1.7.8.6
  • PrestaShop 1.7.8.7
  • PrestaShop 1.7.8.7 1
  • PrestaShop 1.7.8.8
  • PrestaShop 1.7.8.9
  • PrestaShop 1.7.8.10
  • PrestaShop 1.7.8.11
  • PrestaShop 8.0.1
  • PrestaShop 8.0.2
  • PrestaShop 8.0.4
  • PrestaShop 8.1.0
  • PrestaShop 8.1.1
  • PrestaShop 8.1.2
  • PrestaShop 8.1.3
  • PrestaShop 8.1.7
  • PrestaShop 8.2.0
  • PrestaShop 8.2.1
  • PrestaShop 8.2.2
  • PrestaShop 8.2.5
  • PrestaShop 8.2.6
  • PrestaShop 9.0.0-1.0-RC.1
  • PrestaShop 9.0.1-1.0
  • PrestaShop 9.0.2-2.0
  • PrestaShop 9.0.3-3.0
  • PrestaShop 9.1.0-3.0-beta.1
  • PrestaShop 9.1.0-4.0
  • PrestaShop 9.1.0-4.0-RC.1
  • PrestaShop 9.1.3-5.0
  • PrestaShop Faceted Search 3.0.1
  • PrestaShop Faceted Search 3.0.2
  • PrestaShop Faceted Search 3.0.3
  • PrestaShop Faceted Search 3.0.4
  • PrestaShop Faceted Search 3.0.5
  • PrestaShop Faceted Search 3.2.0
  • PrestaShop Faceted Search 3.2.1
  • PrestaShop Faceted Search 3.3.0
  • PrestaShop Faceted Search 3.4.0
  • PrestaShop Faceted Search 3.4.1
  • PrestaShop Faceted Search 3.5.0
  • PrestaShop Faceted Search 3.6.0
  • PrestaShop Faceted Search 3.7.0
  • PrestaShop Faceted Search 3.8.0
  • PrestaShop Faceted Search 3.9.0
  • PrestaShop Faceted Search 3.10.0
  • PrestaShop Faceted Search 3.11.0
  • PrestaShop Faceted Search 3.11.1
  • PrestaShop Faceted Search 3.12.0
  • PrestaShop Faceted Search 3.12.1
  • PrestaShop Faceted Search 3.13.2
  • PrestaShop Faceted Search 3.14.0
  • PrestaShop Faceted Search 3.14.1
  • PrestaShop Faceted Search 3.15.0
  • PrestaShop Faceted Search 3.15.1
  • PrestaShop Faceted Search 3.16.0
  • PrestaShop Faceted Search 3.16.1
  • PrestaShop Faceted Search 4.0.0
  • PrestaShop Faceted Search 4.0.1
  • PrestaShop Faceted Search 4.0.2
  • PrestaShop Faceted Search 4.0.3