PrestaShop anfällig für XSS über das Kundenkontaktformular im FO, durch Dateiupload

The impact of this XSS vulnerability is significant. A successful exploit allows an attacker to upload a malicious file containing JavaScript code via the contact form. When an administrator opens this file in the back office, the script executes within the administrator's session context. This grants the attacker the ability to steal the administrator's session cookie, effectively impersonating the administrator and performing any action they are authorized to do. This includes accessing sensitive customer data, modifying product information, processing fraudulent orders, and potentially gaining complete control over the e-commerce platform. The attack surface is limited to PrestaShop installations with the customer-thread feature enabled, but this feature is commonly used for customer support interactions, increasing the likelihood of exploitation.

PrestaShop installations running versions 8.1.0 through 8.1.5 are at direct risk. Specifically, those deployments that have enabled the customer-thread feature flag through the front-office contact form are the most vulnerable. Shared hosting environments running PrestaShop are also at increased risk due to the potential for cross-tenant contamination.

• php: Examine PrestaShop installation logs for suspicious file uploads via the contact form. Look for unusual file extensions or filenames that might indicate malicious code.

 grep -i 'contact form upload' /var/log/prestashop/error.log

• generic web: Monitor access logs for requests to the contact form endpoint with unusual file uploads. Check response headers for signs of XSS payloads.

curl -I https://example.com/contact_form.php?attachment=malicious.php

• wordpress / composer / npm: (Not applicable - PrestaShop is PHP-based, not WordPress/Composer/npm) • database (mysql, redis, mongodb, postgresql): (Not applicable - vulnerability is not database-specific) • windows / supply-chain: (Not applicable - PrestaShop is not a Windows application) • linux / server: Monitor system processes for unusual PHP scripts being executed, particularly those related to file handling or session management. Use ps aux | grep php to identify running PHP processes.

1. 2024-05-14Disclosure

   disclosure

2. 2024-05-14Patch

   patch

1. Reserviert2024-05-07
2. Veröffentlicht2024-05-14
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-34716 is to immediately upgrade PrestaShop to version 8.1.6 or later. This version includes a patch that addresses the underlying vulnerability. If upgrading is not immediately feasible, consider disabling the customer-thread feature flag through the front-office contact form to remove the attack vector. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to detect and block suspicious file uploads, particularly those containing JavaScript code, can provide an additional layer of defense. Regularly review PrestaShop's security recommendations and apply any relevant configuration changes to harden the platform.