CVE-2023-43981
📋 TL;DR
CVE-2023-43981 is a critical deserialization vulnerability in Presto Changeo testsitecreator that allows remote code execution. Attackers can exploit the delete_excluded_folder.php component to execute arbitrary code on affected systems. This affects all users running testsitecreator version 1.1.1 or earlier.
💻 Affected Systems
- Presto Changeo testsitecreator
📦 What is this software?
Test Site Creator by Presto Changeo
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, install malware, steal data, and pivot to other systems.
Likely Case
Remote code execution leading to web server compromise, data theft, and potential ransomware deployment.
If Mitigated
Limited impact with proper network segmentation, WAF rules blocking suspicious PHP requests, and restricted file permissions.
🎯 Exploit Status
The vulnerability is in a publicly accessible PHP file and requires minimal technical skill to exploit. Public exploit details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.1.2 or later
Vendor Advisory: https://security.friendsofpresta.org/modules/2023/10/03/testsitecreator.html
Restart Required: No
Instructions:
1. Download the latest version from the vendor. 2. Backup current installation. 3. Replace vulnerable files with patched version. 4. Verify the delete_excluded_folder.php file has been updated.
🔧 Temporary Workarounds
Delete vulnerable file
linuxRemove or rename the vulnerable delete_excluded_folder.php file to prevent exploitation
rm /path/to/testsitecreator/delete_excluded_folder.php
mv /path/to/testsitecreator/delete_excluded_folder.php /path/to/testsitecreator/delete_excluded_folder.php.disabled
Web Application Firewall rule
allBlock requests to the vulnerable endpoint using WAF rules
🧯 If You Can't Patch
- Restrict access to the vulnerable PHP file using .htaccess or web server configuration
- Implement network segmentation to isolate affected systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check if delete_excluded_folder.php exists in the testsitecreator directory and examine its contents for insecure deserialization patternsCheck Version:
Check the plugin version in the PrestaShop admin panel or examine the plugin's version fileVerify Fix Applied:
Verify the delete_excluded_folder.php file has been updated to version 1.1.2+ or removed, and test that deserialization attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to delete_excluded_folder.php
- PHP deserialization errors in web server logs
- Unexpected process execution from web server user
Network Indicators:
- HTTP requests to delete_excluded_folder.php with serialized data payloads
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_server_logs" AND uri="*delete_excluded_folder.php*" AND (method="POST" OR status="500")