CVE-2024-34716
📋 TL;DR
This is a stored cross-site scripting (XSS) vulnerability in PrestaShop that allows attackers to upload malicious files through the contact form. When an administrator opens the infected attachment in the back office, the attacker can hijack the admin session and perform any actions with administrator privileges. Only PrestaShop installations with the customer-thread feature flag enabled are affected.
💻 Affected Systems
- PrestaShop
📦 What is this software?
Prestashop by Prestashop
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the e-commerce platform including theft of customer data, financial information, and full administrative control over the store.
Likely Case
Attacker gains administrative access to modify products, steal customer data, or install backdoors for persistent access.
If Mitigated
If proper file upload restrictions and input validation are in place, the attack would be blocked before reaching administrators.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators into opening malicious attachments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1.6
Vendor Advisory: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78
Restart Required: No
Instructions:
1. Backup your PrestaShop installation and database. 2. Download PrestaShop 8.1.6 from the official repository. 3. Replace affected files with patched versions. 4. Clear cache and verify functionality.
🔧 Temporary Workarounds
Disable customer-thread feature flag
allDisables the vulnerable feature entirely, preventing exploitation
Navigate to PrestaShop back office > Advanced Parameters > Feature Flags > Disable 'customer-thread'
🧯 If You Can't Patch
- Implement strict file upload restrictions in web server configuration
- Deploy WAF rules to block malicious file uploads and XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check if PrestaShop version is between 8.1.0-8.1.5 AND customer-thread feature flag is enabledCheck Version:
Check PrestaShop version in back office dashboard or examine /config/defines.inc.phpVerify Fix Applied:
Verify PrestaShop version is 8.1.6 or higher, or customer-thread feature flag is disabled📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads through contact form
- Administrator sessions with abnormal activity patterns
Network Indicators:
- Malicious file uploads containing script tags or JavaScript payloads
SIEM Query:
source="prestashop" AND (event="file_upload" AND file_extension IN ("html", "htm", "svg") OR event="admin_login" FROM unusual_location)