CVE-2022-21686 Server Side Twig Template Injection in PrestaShop
Attackers can inject Twig code in the PrestaShop back office when using the legacy layout, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21686?
CVE-2022-21686 is a critical code injection vulnerability in Prestashop Prestashop, published on 26 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
Weakness: CWE-94
Which versions are affected by CVE-2022-21686?
2 open source packages ship an affected version, including prestashop/prestashop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/prestashop Packagist | From 1.7.0.0 | 1.7.8.3 |
prestashop/prestashop Packagist | From 1.7.0.0 | 1.7.8.3 |
Products include Prestashop Prestashop.
How do I fix CVE-2022-21686?
Upgrade prestashop/prestashop to 1.7.8.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-21686 being exploited?
There is no known exploitation of CVE-2022-21686 in the wild and no public exploit code.
Other vulnerabilities in Prestashop Prestashop
Sources
Also known as GHSA-mrq4-7ch7-2465.