CVE-2024-24304
📋 TL;DR
The Mailjet module for PrestaShop before version 3.5.1 contains an information disclosure vulnerability that allows unauthenticated guests to download technical information without restrictions. This affects PrestaShop installations using the vulnerable Mailjet plugin. Attackers can exploit this to access sensitive technical data that should be protected.
💻 Affected Systems
- Mailjet module for PrestaShop
📦 What is this software?
Mailjet by Sinch
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain sensitive technical information about the PrestaShop installation, Mailjet configuration, or other system details that could facilitate further attacks, potentially leading to complete system compromise.
Likely Case
Unauthenticated users accessing technical information that reveals system configuration, plugin details, or other data that could aid in reconnaissance for additional attacks.
If Mitigated
With proper access controls and the patch applied, only authorized users can access technical information, limiting exposure to sensitive data.
🎯 Exploit Status
The vulnerability allows unauthenticated access to technical information, making exploitation straightforward for attackers who discover the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.1
Vendor Advisory: https://github.com/mailjet/prestashop-mailjet-plugin-apiv3/releases/tag/v3.5.1
Restart Required: No
Instructions:
1. Download Mailjet module version 3.5.1 or later from the official repository. 2. In PrestaShop admin panel, go to Modules > Module Manager. 3. Upload the new module version. 4. Replace/upgrade the existing Mailjet module. 5. Clear PrestaShop cache if necessary.
🔧 Temporary Workarounds
Temporary Access Restriction
allImplement web server rules to restrict access to the Mailjet module endpoints from unauthorized users.
# Example Apache .htaccess rule
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
# Example Nginx location block
location ~ /modules/mailjet/ {
deny all;
allow 192.168.1.0/24;
}
🧯 If You Can't Patch
- Disable the Mailjet module temporarily until patching is possible.
- Implement network-level access controls to restrict external access to the PrestaShop installation.
🔍 How to Verify
Check if Vulnerable:
Check the Mailjet module version in PrestaShop admin panel under Modules > Module Manager. If version is below 3.5.1, the system is vulnerable.Check Version:
Check in PrestaShop admin: Modules > Module Manager > Mailjet module detailsVerify Fix Applied:
After updating, verify the module shows version 3.5.1 or higher in the PrestaShop admin panel. Test that unauthenticated users cannot access technical information endpoints.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Mailjet module endpoints from unauthenticated users
- Multiple failed or successful requests to technical information endpoints from external IPs
Network Indicators:
- HTTP requests to /modules/mailjet/ endpoints from unauthenticated sources
- Unusual data downloads from Mailjet module paths
SIEM Query:
source="web_server" AND (uri="/modules/mailjet/*" OR user_agent="*" AND status=200) AND user="-"