CVE-2018-20717 PrestaShop PHP Object Injection
Authenticated attackers with Salesman privileges can achieve remote code execution via PHP object injection in PrestaShop orders.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20717?
CVE-2018-20717 is a high-severity unsafe deserialization vulnerability in Prestashop Prestashop, published on 15 Jan 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a 0: followed by an integer, but does not consider 0:+ followed by an integer.
Weakness: CWE-94
Which versions are affected by CVE-2018-20717?
2 open source packages ship an affected version, including prestashop/prestashop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/prestashop Packagist | All versions | 1.7.2.5 |
prestashop/prestashop Packagist | All versions | 1.7.2.5 |
Products include Prestashop Prestashop.
How do I fix CVE-2018-20717?
Upgrade prestashop/prestashop to 1.7.2.5 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2018-20717 being exploited?
There is no known exploitation of CVE-2018-20717 in the wild and no public exploit code.
Other vulnerabilities in Prestashop Prestashop
Sources
Also known as GHSA-xx67-2j3v-h76p.