CVE-2023-27033
📋 TL;DR
This vulnerability allows remote code execution via code injection in the Prestashop cdesigner module. Attackers can execute arbitrary code on affected systems by exploiting the CdesignerSaverotateModuleFrontController::initContent() component. All Prestashop installations using cdesigner v3.1.3 to v3.1.8 are affected.
💻 Affected Systems
- Prestashop cdesigner module
📦 What is this software?
Cdesigner by Cdesigner Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal data, install malware, or pivot to other systems.
Likely Case
Website defacement, data theft, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper web application firewalls and input validation are in place.
🎯 Exploit Status
Public exploit details available in security advisories, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.1.9 or later
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/04/06/cdesigner-CWE434.html
Restart Required: No
Instructions:
1. Update cdesigner module to v3.1.9 or later via Prestashop admin panel. 2. Verify update completes successfully. 3. Clear Prestashop cache.
🔧 Temporary Workarounds
Disable cdesigner module
allTemporarily disable the vulnerable module until patching is possible.
Navigate to Prestashop admin > Modules > Module Manager > Find cdesigner > Disable
Web Application Firewall rule
allBlock malicious requests targeting the vulnerable endpoint.
Add WAF rule to block requests to /module/cdesigner/saverotate endpoint
🧯 If You Can't Patch
- Isolate affected Prestashop instance from critical systems and databases.
- Implement strict network segmentation and monitor for exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check cdesigner module version in Prestashop admin panel under Modules > Module Manager.Check Version:
Check via Prestashop admin interface or database query: SELECT version FROM ps_module WHERE name='cdesigner'Verify Fix Applied:
Confirm cdesigner module version is v3.1.9 or later in module manager.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /module/cdesigner/saverotate
- Suspicious PHP code execution in web logs
Network Indicators:
- HTTP requests with malicious payloads to vulnerable endpoint
- Unexpected outbound connections from web server
SIEM Query:
source="web_logs" AND uri="/module/cdesigner/saverotate" AND (method="POST" OR status_code>=400)🔗 References
- https://addons.prestashop.com/fr/declinaisons-personnalisation/22677-personnalisation-de-produit-product-customize.html
- https://friends-of-presta.github.io/security-advisories/modules/2023/04/06/cdesigner-CWE434.html
- https://addons.prestashop.com/fr/declinaisons-personnalisation/22677-personnalisation-de-produit-product-customize.html
- https://friends-of-presta.github.io/security-advisories/modules/2023/04/06/cdesigner-CWE434.html
