CVE-2023-29631
📋 TL;DR
CVE-2023-29631 is an incorrect access control vulnerability in PrestaShop's jmsslider module that allows unauthenticated attackers to execute arbitrary PHP code via the ajax_jmsslider.php endpoint. This affects all PrestaShop installations using jmsslider version 1.6.0, potentially leading to complete system compromise.
💻 Affected Systems
- PrestaShop jmsslider module
📦 What is this software?
Jms Slider by Joommasters
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server takeover, data theft, malware deployment, and lateral movement within the network.
Likely Case
Unauthenticated attackers upload web shells, deface websites, steal customer data, and establish persistent backdoors.
If Mitigated
With proper network segmentation and WAF rules, impact limited to the web application layer only.
🎯 Exploit Status
Exploit requires simple HTTP POST requests to the vulnerable endpoint. Multiple public exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.1
Vendor Advisory: https://friends-of-presta.github.io/security-advisories/modules/2023/03/13/jmsslider.html
Restart Required: No
Instructions:
1. Download jmsslider 1.6.1 from PrestaShop Addons marketplace. 2. Replace the existing jmsslider module folder. 3. Clear PrestaShop cache from Advanced Parameters > Performance.
🔧 Temporary Workarounds
Delete vulnerable file
linuxRemove the vulnerable ajax_jmsslider.php file to prevent exploitation
rm -f modules/jmsslider/ajax_jmsslider.php
Restrict file access via .htaccess
allBlock access to the vulnerable endpoint using Apache mod_rewrite
RewriteRule ^modules/jmsslider/ajax_jmsslider\.php$ - [F,L]
🧯 If You Can't Patch
- Implement WAF rules to block requests to /modules/jmsslider/ajax_jmsslider.php
- Restrict network access to PrestaShop admin panel and vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Check if file exists: ls -la modules/jmsslider/ajax_jmsslider.phpCheck Version:
grep -r 'version' modules/jmsslider/ || echo 'Check module admin panel'Verify Fix Applied:
Verify jmsslider version in module configuration or check file modification date📡 Detection & Monitoring
Log Indicators:
- POST requests to /modules/jmsslider/ajax_jmsslider.php
- Unusual file uploads in jmsslider directory
- PHP code execution errors
Network Indicators:
- HTTP POST to ajax_jmsslider.php with file upload parameters
- Unusual outbound connections from web server
SIEM Query:
source="web_access.log" AND uri="/modules/jmsslider/ajax_jmsslider.php" AND method="POST"