GHSA-wqq8-mqj9-697f PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
Attackers can execute arbitrary code on PrestaShop servers via vulnerable PHPUnit scripts included in autoupgrade module archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wqq8-mqj9-697f?
GHSA-wqq8-mqj9-697f is a code injection vulnerability in prestashop/autoupgrade, published on 8 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.
This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in CVE-2017-9841
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)
You can read PrestaShop official statement about this vulnerability here.
Patches
In the security patch, we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.
Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.
References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841
For more information
If you have any questions or comments about this advisory, email us at [email protected]
Which versions are affected by GHSA-wqq8-mqj9-697f?
2 open source packages ship an affected version, including prestashop/autoupgrade.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/autoupgrade Packagist | From 4.0.0 | 4.10.1 |
prestashop/autoupgrade Packagist | From 4.0.0 | 4.10.1 |
How do I fix GHSA-wqq8-mqj9-697f?
Upgrade prestashop/autoupgrade to 4.10.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-wqq8-mqj9-697f being exploited?
There is no known exploitation of GHSA-wqq8-mqj9-697f in the wild and no public exploit code.