CVE-2023-26691
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on CS-Cart MultiVendor systems through directory traversal in zip file handling during add-on installation. Attackers can upload malicious zip files that extract files outside intended directories, leading to remote code execution. All users running vulnerable versions of CS-Cart MultiVendor are affected.
💻 Affected Systems
- CS-Cart MultiVendor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install backdoors, or pivot to other systems.
Likely Case
Web server compromise leading to data theft, defacement, or installation of cryptocurrency miners or malware.
If Mitigated
Attack fails due to proper input validation and file extraction restrictions, resulting in no impact.
🎯 Exploit Status
Exploitation requires administrative access or ability to upload zip files through the add-on installation interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16.2 or later
Vendor Advisory: https://www.cs-cart.com/
Restart Required: No
Instructions:
1. Backup your CS-Cart installation and database. 2. Download the latest version from the official CS-Cart website. 3. Follow the official upgrade instructions for your version. 4. Verify the patch by checking the version number.
🔧 Temporary Workarounds
Disable Add-on Installation
allTemporarily disable the ability to install new add-ons through the admin interface.
Restrict File Uploads
allImplement web application firewall rules to block suspicious zip file uploads.
🧯 If You Can't Patch
- Implement strict file upload validation and sanitization for zip files
- Restrict administrative access to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if running CS-Cart MultiVendor version 4.16.1 or earlier by examining the version in admin panel or configuration files.Check Version:
Check admin panel dashboard or examine includes/config.php for version informationVerify Fix Applied:
Verify installation of version 4.16.2 or later and test zip file upload functionality with malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual zip file uploads to add-on installation endpoints
- File extraction attempts outside designated directories
- Suspicious file creation in system directories
Network Indicators:
- HTTP POST requests with zip files to admin/addon_install endpoints
- Unusual outbound connections from web server
SIEM Query:
source="web_server" AND (uri_path="/admin/addon_install" OR uri_path="/admin.php?dispatch=addons.install") AND file_extension="zip"