[CVE-2024-28390] Improper Access Control in Advanced Plugins – Image: WebP, Compress, Zoom, Lazy load, Alt & More module for PrestaShop

PrestaShop Security Advisory

In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.2.01 from Advanced Plugins for PrestaShop, a guest can update all configurations of the PrestaShop.

Summary

  • CVE ID: CVE-2024-28390
  • Published at: 2024-03-12
  • Platform: PrestaShop
  • Product: ultimateimagetool
  • Impacted release: < 2.2.01 (2.2.01 fixed the vulnerability)
  • Product author: Advanced Plugins
  • Weakness: CWE-284
  • Severity: critical (9.1)

Description

Due to a predictable token, a guest can update all configurations of the PrestaShop.

Be warned that the author do not follow a compliant semver version.

Note : the author has deleted from his module the files that have been suffering from critical vulnerabilities for months, BUT did not set them to be “auto-deleted” during upgrades. Therefore, there are likely merchants out there with older versions who have updated their modules, thinking they are safe. However, there is nothing safe about that, since past upgrades did not auto-delete the implicated files. To ensure everyone has a “safe version”, we decided to mark all versions up to 2.2.01 as impacted by this issue.

This exploit uses a PrestaShop front controller and most attackers can conceal the module controller’s path during the exploit, so you will never know within your conventional frontend logs that it exploits this vulnerability. You will only see “POST /” inside your conventional frontend logs. Activating the AuditEngine of mod_security (or similar) is the only way to get data to confirm this exploit.

CVSS base metrics

  • Attack vector: network
  • Attack complexity: low
  • Privilege required: none
  • User interaction: none
  • Scope: unchanged
  • Confidentiality: none
  • Integrity: high
  • Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Possible malicious usage

  • Erase/update all configurations from the PrestaShop
  • Disable critical security configuration

Other recommendations

  • It’s recommended to upgrade to the latest version of the module ultimateimagetool.
  • You should consider updating the configuration uit_token for something not predictable

Timeline

DateAction
2023-07-22Issue discovered during a code review by TouchWeb.fr
2023-07-22Contact PrestaShop Addons security Team to confirm version scope by author
2024-01-24Contact PrestaShop Addons security Team confirms version scope by author
2024-01-27Author provide a “complete” patch which auto-delete old file from previous version
2024-03-11Received CVE ID
2024-03-12Publish this security advisory

READ MORE

Leave a Reply

Your email address will not be published. Required fields are marked *