CVE-2022-21686
📋 TL;DR
This vulnerability allows attackers to inject Twig template code into the PrestaShop back office when using legacy layouts. Successful exploitation could lead to remote code execution or data manipulation. All PrestaShop installations from version 1.7.0.0 through 1.7.8.2 are affected.
💻 Affected Systems
- PrestaShop
📦 What is this software?
Prestashop by Prestashop
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Back office compromise allowing administrative access, data manipulation, or privilege escalation.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to back office.
🎯 Exploit Status
Requires access to back office interface. No public exploit code available at time of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.8.3
Vendor Advisory: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465
Restart Required: No
Instructions:
1. Backup your PrestaShop installation and database. 2. Download version 1.7.8.3 from official PrestaShop repository. 3. Replace affected files with patched versions. 4. Clear cache and verify functionality.
🔧 Temporary Workarounds
Disable Legacy Layout
allSwitch from legacy layout to modern layout in back office settings
Restrict Back Office Access
linuxLimit access to back office interface using firewall rules or IP whitelisting
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit back office access to trusted IPs only
- Enable detailed logging and monitoring of back office access attempts and Twig template execution
🔍 How to Verify
Check if Vulnerable:
Check PrestaShop version in administration panel or examine /config/settings.inc.php for version informationCheck Version:
grep '_PS_VERSION_' /path/to/prestashop/config/settings.inc.phpVerify Fix Applied:
Verify version is 1.7.8.3 or higher in administration panel or settings file📡 Detection & Monitoring
Log Indicators:
- Unusual Twig template execution in back office logs
- Multiple failed login attempts followed by successful back office access
- Unexpected file modifications in templates directory
Network Indicators:
- Unusual HTTP POST requests to back office endpoints with Twig code patterns
- Traffic from unexpected sources to administrative interfaces
SIEM Query:
source="prestashop_logs" AND ("twig injection" OR "template execution" OR "backoffice access" from suspicious_ip)🔗 References
- https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21
- https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.3
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465
- https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21
- https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.3
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465
