CVE-2024-21518
📋 TL;DR
This Zip Slip vulnerability in OpenCart's marketplace installer allows attackers to upload malicious ZIP archives that can extract files to arbitrary locations on the filesystem. Attackers can overwrite existing files or create new files in the web root, potentially leading to remote code execution. This affects OpenCart installations running version 4.0.0.0.
💻 Affected Systems
- OpenCart
📦 What is this software?
Opencart by Opencart
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Webshell installation allowing persistent access, defacement, or data exfiltration.
If Mitigated
Limited to file overwrites in web-accessible directories without code execution.
🎯 Exploit Status
Exploitation requires admin privileges to access the marketplace installer.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.2.3
Vendor Advisory: https://github.com/opencart/opencart/security/advisories/GHSA-9r8q-8h7h-5w5w
Restart Required: No
Instructions:
1. Backup your OpenCart installation and database. 2. Download OpenCart 4.0.2.3 or newer from the official repository. 3. Replace the affected file: upload/admin/controller/marketplace/installer.php with the patched version. 4. Clear OpenCart cache.
🔧 Temporary Workarounds
Disable Marketplace Installer
linuxTemporarily disable the marketplace installer functionality to prevent exploitation.
mv upload/admin/controller/marketplace/installer.php upload/admin/controller/marketplace/installer.php.disabled
Restrict Admin Access
allLimit admin panel access to trusted IP addresses only.
Add IP restrictions to .htaccess or web server configuration for /admin directory
🧯 If You Can't Patch
- Disable the marketplace installer module completely.
- Implement strict file upload validation and monitoring for ZIP file extraction activities.
🔍 How to Verify
Check if Vulnerable:
Check if OpenCart version is 4.0.0.0 by viewing the version in admin panel or checking system/info.php.Check Version:
php -r "include 'config.php'; echo VERSION;"Verify Fix Applied:
Verify the installer.php file contains proper path sanitization (check for realpath() usage and directory traversal prevention).📡 Detection & Monitoring
Log Indicators:
- Unusual ZIP file uploads via marketplace installer
- File extraction to unexpected directories
- Admin user performing unexpected marketplace installations
Network Indicators:
- POST requests to /admin/index.php?route=marketplace/installer.install with ZIP payloads
SIEM Query:
source="web_access_logs" AND uri="/admin/index.php" AND query="route=marketplace/installer.install" AND method="POST"🔗 References
- https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1
- https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266578
- https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1
- https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266578
