CVE-2024-25844
📋 TL;DR
A vulnerability in the Common-Services 'So Flexibilite' module for PrestaShop allows remote attackers to access debug files containing sensitive information, potentially leading to privilege escalation. This affects PrestaShop installations using the soflexibilite module before version 4.1.26. Attackers can exploit this to gain unauthorized access to system data.
💻 Affected Systems
- PrestaShop with Common-Services 'So Flexibilite' module
📦 What is this software?
So Flexibilite by Common Services
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through privilege escalation leading to administrative access, data exfiltration, and potential lateral movement within the PrestaShop environment.
Likely Case
Unauthorized access to sensitive debug information including configuration details, database credentials, and user data, enabling further attacks.
If Mitigated
Limited information disclosure with no direct system access if proper file permissions and access controls are implemented.
🎯 Exploit Status
Exploitation involves accessing debug files through predictable URLs or directory traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.26
Vendor Advisory: https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-soflexibilite.md
Restart Required: No
Instructions:
1. Log into PrestaShop admin panel. 2. Navigate to Modules > Module Manager. 3. Update 'So Flexibilite' module to version 4.1.26 or later. 4. Clear PrestaShop cache.
🔧 Temporary Workarounds
Remove debug files
linuxManually locate and delete debug files generated by the soflexibilite module
find /path/to/prestashop -name "*debug*" -type f -delete
Restrict file access
allConfigure web server to deny access to debug files
Add 'Deny from all' to .htaccess in module directories
🧯 If You Can't Patch
- Disable the soflexibilite module entirely
- Implement strict web application firewall rules blocking access to debug file patterns
🔍 How to Verify
Check if Vulnerable:
Check module version in PrestaShop admin panel under Modules > Module Manager > So FlexibiliteCheck Version:
grep -r "soflexibilite" /path/to/prestashop/modules/ | grep versionVerify Fix Applied:
Confirm module version is 4.1.26 or later and attempt to access debug URLs returns 403/404📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to URLs containing 'debug' in path
- Unusual file access patterns to module directories
Network Indicators:
- GET requests to paths containing '/modules/soflexibilite/' and 'debug'
SIEM Query:
source="web_logs" AND (url="*debug*" OR url="*soflexibilite*") AND response="200"