Headline

CVE-2023-27640: [CVE-2023-27639][CVE-2023-27640][CWE-22] Multiple path traversal in Custom Product Designer (tshirtecommerce) module for PrestaShop

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter type in the /tshirtecommerce/fonts.php endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). The content of the file is returned with base64 encoding. This is exploited in the wild in March 2023.

1 year ago

CVE

Open in Source

#sql #vulnerability #web #apache #php #auth

In the Custom Product Designer (tshirtecommerce) module for PrestaShop, HTTP requests can be forged using POST and GET parameters enabling a remote attacker to perform directory traversal on the system and view the contents of code files. Since the module appears not to have been maintained since 2019, it is strongly recommended to remove it.

Summary

CVE ID: CVE-2023-27639 / CVE-2023-27640
Published at: 2023-03-30
Advisory source: Friends-Of-Presta
Platform: PrestaShop
Product: tshirtecommerce
Impacted release: <= 2.1.4 (latest version)
Product author: Tshirtecommerce Team
Weakness: CWE-22
Severity: high (7.5)

Description

The following issues have been seen in the latest version of the Prestashop Custom Product Designer (tshirtecommerce) module for PrestaShop, released on July 24, 2019 (These issues remain unresolved in the most recent version of the module) :

an HTTP request can be manipulated using the GET parameter type in the /tshirtecommerce/fonts.php endpoint, enabling a remote attacker to perform directory traversal on the system and open files without restrictions on the extension and path. The content of the file will be returned in base64-encoded format.
an HTTP request can be manipulated using the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, enabling a remote attacker to perform directory traversal on the system and open files without restrictions on the extension and path. Note that only files that can be parsed in XML format can be opened.

CVSS base metrics

Attack vector: network
Attack complexity: low
Privilege required: none
User interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Possible malicious usage

Obtain database access
Extract sensitive data, such as tokens or private keys stored in config files
Extract other private data, such as log files or exports

Proof of concept

Examples:

For all types of files, will return a base64 response of the content of the file (critical):
```
https://example.test/tshirtecommerce/fonts.php?name=2&type=./../index.php
```

When a file can be parsed as XML without error (less common):

curl --request POST 'https://example.test/tshirtecommerce/ajax.php?type=svg' \
--data-urlencode 'url=./../vendor/jdorn/sql-formatter/examples' \
--data-urlencode 'file_name=examples.php'

Patch

--- a/tshirtecommerce/fonts.php        
+++ b/tshirtecommerce/fonts.php        
@@ -85,6 +85,24 @@ if (isset($_GET['name']) && isset($_GET['type']))
                else
                {
                        $file_font = ROOT .DS. $font_type;
+            
+            // Array of allowed font file extensions
+            $allowed_extensions = array('ttf', 'otf', 'woff', 'woff2', 'eot', 'svg');
+            // Get the file extension of the file_font
+            $file_extension = strtolower(pathinfo($file_font, PATHINFO_EXTENSION));
+            // Check if the file extension is one of the allowed font types
+            if (!in_array($file_extension, $allowed_extensions)) {
+                exit();
+            } 
+            // tshirtecommerce base path
+            $tshirtecommerceBase = realpath(dirname(__FILE__));
+            // requested file path
+            $fileRealPath = realpath($file_font);
+            if ($fileRealPath === false || strpos($fileRealPath, $tshirtecommerceBase) !== 0) {
+                // Directory transversal
+                exit();
+            }
+

In the function getSVG.

--- a/tshirtecommerce/includes/functions.php   
+++ b/tshirtecommerce/includes/functions.php   
@@ -1480,6 +1480,22 @@ class dg{
                        $file           = $url . 'print/' . $file_name;
                else
                        $file           = $url . '/' . $file_name;
+        
+        // tshirtecommerce base path
+        $tshirtecommerceBase = realpath(dirname(__FILE__)."/../");
+        // requested file path
+        $fileRealPath = realpath($file);
+        if ($fileRealPath === false || strpos($fileRealPath, $tshirtecommerceBase) !== 0) {
+            // Directory transversal
+            exit();
+        }
+
+        // Check if extension if SVG
+        // Warning : This code might break things if tshirtecommerce is waiting for other file extensions
+        $pathinfo = pathinfo($file);
+        if ($pathinfo['extension'] != 'svg') {
+            exit();
+        }

Timeline

Date

Action

2022-10-23

First detection in Apache logs of an exploitation of this module

2023-03-04

Discovery of the vulnerability by Profileo

2023-03-04

Contacting the editor (no reply)

2023-03-04

Contacting codecanyon / envato market (no reply)

2023-03-07