CVE-2023-46352 – This vulnerability allows unauthenticated guest... (How to Fix)

Q: What is the severity of CVE-2023-46352?

CVE-2023-46352 has a CVSS score of 7.5 (HIGH). This vulnerability allows unauthenticated guests to download customer personal information from PrestaShop stores using the vulnerable Facebook conversion tracking module. Attackers can access names, surnames, and email addresses from the ps_customer table without any authentication. All PrestaShop stores using the affected module versions are at risk.

📋 TL;DR

This vulnerability allows unauthenticated guests to download customer personal information from PrestaShop stores using the vulnerable Facebook conversion tracking module. Attackers can access names, surnames, and email addresses from the ps_customer table without any authentication. All PrestaShop stores using the affected module versions are at risk.

💻 Affected Systems

Products:

Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module (facebookconversiontrackingplus)

Versions: Up to version 2.4.9

Operating Systems: All operating systems running PrestaShop

Default Config Vulnerable: ⚠️ Yes

Notes: Affects PrestaShop installations with the vulnerable module enabled. The module must be installed and active.

📦 What is this software?

Facebookconversiontrackingplus by Smartmodules

View all CVEs affecting Facebookconversiontrackingplus →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Mass exfiltration of all customer PII including names and email addresses, leading to data breach notifications, regulatory fines, and reputational damage.

🟠

Likely Case

Targeted harvesting of customer email addresses for spam/phishing campaigns or sale on dark web markets.

🟢

If Mitigated

No data exposure if module is patched or removed, or if access controls are properly implemented.

🌐 Internet-Facing: HIGH - The vulnerability affects web-facing PrestaShop stores and requires no authentication.

🏢 Internal Only: LOW - This is primarily an internet-facing application vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is simple to exploit - attackers only need to access specific module export endpoints without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 2.5.0 or later

Vendor Advisory: https://addons.prestashop.com/en/analytics-statistics/18739-pixel-plus-events-capi-pixel-catalog-for-facebook.html

Restart Required: No

Instructions:

1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Find 'Pixel Plus: Events + CAPI + Pixel Catalog for Facebook'. 4. Update to version 2.5.0 or later. 5. Clear PrestaShop cache.

🔧 Temporary Workarounds

Disable vulnerable module

all

Temporarily disable the module until patching is possible

Restrict module endpoint access

linux

Use web server rules to block access to module export endpoints

# Apache .htaccess example
RewriteRule ^modules/facebookconversiontrackingplus/export - [F,L]

🧯 If You Can't Patch

Disable the facebookconversiontrackingplus module immediately
Implement WAF rules to block requests to module export endpoints

🔍 How to Verify

Check if Vulnerable:

Check module version in PrestaShop admin: Modules > Module Manager > find 'Pixel Plus: Events + CAPI + Pixel Catalog for Facebook'

Check Version:

No CLI command - check via PrestaShop admin interface

Verify Fix Applied:

Confirm module version is 2.5.0 or higher in module manager

📡 Detection & Monitoring

Log Indicators:

HTTP requests to /modules/facebookconversiontrackingplus/export endpoints from unauthenticated users
Unusual download patterns of customer data exports

Network Indicators:

HTTP GET requests to module export endpoints without authentication headers

SIEM Query:

web_access_logs | where url contains "/modules/facebookconversiontrackingplus/export" and user_agent not contains "admin"

📊 Metadata

CVE ID: CVE-2023-46352

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-862

Published: November 2, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-46352, you might also want to check these: