CVE-2024-36694
📋 TL;DR
OpenCart 4.0.2.3 contains a Server-Side Template Injection vulnerability in the Theme Editor function that allows authenticated attackers to execute arbitrary code on the server. This affects OpenCart administrators with theme editing permissions. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- OpenCart
📦 What is this software?
Opencart by Opencart
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full server takeover, data theft, and lateral movement within the network
Likely Case
Unauthorized file system access, data exfiltration, and backdoor installation
If Mitigated
Limited impact if proper access controls and input validation are implemented
🎯 Exploit Status
Exploit requires authenticated admin access but is straightforward to execute
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 4.0.2.4 or later
Vendor Advisory: https://github.com/opencart/opencart/releases/tag/4.0.2.3
Restart Required: No
Instructions:
1. Backup your OpenCart installation and database. 2. Download the latest OpenCart version. 3. Replace affected files with patched versions. 4. Clear cache and verify functionality.
🔧 Temporary Workarounds
Disable Theme Editor
allRemove or restrict access to the theme editor functionality
# Remove or rename the theme editor files
# Example: mv admin/controller/design/theme.php admin/controller/design/theme.php.disabled
Restrict Admin Access
allImplement strict access controls and multi-factor authentication for admin accounts
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to OpenCart admin interface
- Deploy web application firewall (WAF) with SSTI detection rules and monitor for suspicious template injection attempts
🔍 How to Verify
Check if Vulnerable:
Check if running OpenCart version 4.0.2.3 and verify theme editor functionality is accessibleCheck Version:
Check OpenCart version in admin dashboard or examine system/config.php fileVerify Fix Applied:
Confirm OpenCart version is 4.0.2.4 or later and test theme editor for SSTI payloads📡 Detection & Monitoring
Log Indicators:
- Unusual theme editor access patterns
- Suspicious template syntax in POST requests
- Unexpected file creation/modification
Network Indicators:
- POST requests to theme editor endpoints containing template injection payloads
SIEM Query:
source="web_logs" AND (uri="/admin/index.php?route=design/theme" OR uri="/admin/controller/design/theme") AND (payload CONTAINS "{{" OR payload CONTAINS "{%" OR payload CONTAINS "{#")🔗 References
- https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md
- https://github.com/PawaritSanguanpang/CVEs/blob/main/OpenCart/CVE-2024-36694/README.md
- https://github.com/opencart/opencart/issues/13863
- https://github.com/opencart/opencart/releases/tag/4.0.2.3
- https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9
- https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9
