0-day vulnerability in PrestaShop

What Happened The PrestaShop Development and Maintenance Team was made aware that attackers were exploiting a set of known and unknown CMS vulnerabilities to inject malicious code into websites built in PrestaShop, allowing them to execute arbitrary instructions and potentially steal customer payment information.

In analyzing these attacks, the PrestaShop team has identified a chain of unknown vulnerabilities that are being patched. The problem affects shops based on versions 1.6.0.10 or later, which are subject to SQL Injection vulnerabilities.

Versions 1.7.8.2 and later are not vulnerable as long as they are not running a module or custom code that includes a SQL Injection vulnerability.

Versions 2.0.0 and 2.1.0 of the "Wishlist" (blockwishlist) module are vulnerable.

How the attack works The attack requires that the shop is vulnerable to SQL Injection exploits. To date, the development team believes that the latest version of PrestaShop and its default modules are free of such vulnerabilities.

The attackers targeted shops that use obsolete software or third-party modules that are vulnerable or have unknown vulnerabilities.

The recurring modus operandi is similar to the following:

The attacker sends a POST request to the endpoint vulnerable to SQL Injection.

After about a second, the attacker sends a GET request to the homepage with no parameters. This results in a PHP file called blm.php that is created in the shop root.

The attacker now sends a GET request to the newly created blm.php file, allowing him to execute arbitrary instructions.

After taking control of the shop, the attackers inject a fake payment form into the public checkout page. In this scenario, shop customers could enter their credit card information into the fake form, unknowingly sending it to the attackers.

This has been the common attack pattern so far, however attackers may use a different one, using different file names, modifying other parts of the software, or removing their traces after the attack.

What to do to keep your shop safe First of all, make sure that your shop and all installed modules are updated to the latest version available. This should prevent your shop from being exposed to known and actively exploited vulnerabilities.

Attackers could use Smarty cache's MySQL storage capabilities as part of the attack vector. These features are rarely used and disabled by default, but could be activated remotely by the attacker.

Until an official patch is released, it is recommended to physically disable this feature in your PrestaShop code to block the attack chain.

To do this, locate the config/smarty.config.inc.php file in your PrestaShop installation, and remove lines 43-46 (in case of PrestaShop 1.7) or 40-43 (PrestaShop 1.6).

if ( Configuration :: get ( 'PS_SMARTY_CACHING_TYPE' ) == 'mysql' ) { include _PS_CLASS_DIR_ . 'Smarty/SmartyCacheResourceMysql.php' ; $smarty -> caching_type = 'mysql' ; } How to check if you have been attacked Check your server's access logs for the above attack patterns.

[14/Jul/2022:16:20:56 +0200] "POST /modules/XXX/XXX.php HTTP/1.1" 200 82772 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS Version/10.0.1 Safari/602.2.14" - [14/Jul/2022:16:20:57 +0200] "GET / HTTP/1.1" 200 63011 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS Chrome/54.0.2840.98 Safari/537.36" - [14/Jul/2022:16:20:58 +0200] "POST /blm.php HTTP/1.1" 200 82696 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0" (The path has been changed for security reasons.)

Not finding these patterns does not mean that the site was not attacked. Unfortunately, the complexity of the attack means that other paths or ways could have been used to exploit the vulnerability.

Also checking the modification dates of the web space files helps to identify any tampering.

Learn more The PrestaShop development team is currently preparing and testing a patch to secure the shops.

Practical advice Make sure you have the latest versions of PrestaShop and modules installed (including themes).

In case of PrestaShop 1.7.1 and later, use the following Open Source module to check for the presence of the vulnerability: https://github.com/MathiasReker/blmvuln

Make the change to the Smarty Cache configuration as indicated in the previous paragraphs.

Check the access logs of your hosting.

Check the modification date of the files in your web space.

Update 07/25/2022 The PrestaShop Team has released the new version of PrestaShop 1.7.8.7 which fixes the vulnerability. Updating is recommended.