CVE-2024-34717 Overview
CVE-2024-34717 is an information disclosure vulnerability in PrestaShop, an open-source e-commerce web application. In version 8.1.5, the front-office invoice download endpoint accepts any value for the secure_key URL parameter. An unauthenticated attacker can iterate invoice identifiers and retrieve arbitrary customer invoices without authentication. The flaw is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Invoices commonly contain personally identifiable information (PII), including billing addresses, purchased items, and order totals. PrestaShop resolved the issue in version 8.1.6, and no workarounds are documented.
Critical Impact
Unauthenticated remote attackers can download any customer invoice from the PrestaShop front-office by supplying an arbitrary secure_key query parameter, exposing customer PII and order data.
Affected Products
- PrestaShop 8.1.5
- Earlier PrestaShop 8.1.x builds sharing the same invoice download logic
- Deployments upgraded from unpatched branches without applying 8.1.6
Discovery Timeline
- 2024-05-14 - CVE-2024-34717 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34717
Vulnerability Analysis
The vulnerability resides in the front-office invoice download workflow. PrestaShop protects invoice downloads with a secure_key parameter tied to the customer account. In version 8.1.5, the server-side handler fails to validate the supplied secure_key against the expected value stored for the invoice or associated order. As a result, any string passed in the parameter is accepted as valid. An attacker can request invoices anonymously by iterating numeric invoice identifiers and appending an arbitrary secure_key value. The response returns a PDF invoice containing customer details, order line items, prices, and billing addresses. Because the endpoint is reachable without authentication, exploitation requires only HTTP access to the storefront.
Root Cause
The root cause is a missing or improperly implemented authorization check on the invoice download controller. The secure_key was intended as a capability token, yet its comparison logic did not enforce equality against the persisted value. This is a classic broken access control pattern where a security-relevant parameter is trusted without server-side verification.
Attack Vector
Exploitation occurs over the network with no privileges and no user interaction. An attacker crafts a GET request to the front-office invoice download URL, substituting a random string for secure_key and enumerating invoice IDs. Automated scanning can harvest large volumes of invoices from vulnerable storefronts.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-7pjr-2rgh-fc5g for vendor-supplied technical details.
Detection Methods for CVE-2024-34717
Indicators of Compromise
- Repeated anonymous GET requests to invoice download endpoints containing varying secure_key values
- Sequential enumeration patterns against invoice identifier parameters from a single source IP
- Unusual volumes of PDF responses served from front-office invoice routes without an authenticated session cookie
Detection Strategies
- Review web server access logs for requests to invoice download URLs containing the secure_key parameter without a corresponding authenticated session.
- Alert on high-rate access to invoice endpoints from client IPs with no prior authentication or checkout activity.
- Compare secure_key values in request logs against expected per-order values recorded in the PrestaShop database.
Monitoring Recommendations
- Forward PrestaShop front-office access logs to a centralized logging platform and retain them for correlation.
- Track baseline invoice download volumes and flag statistically significant spikes.
- Monitor egress traffic for automated PDF harvesting patterns targeting e-commerce hosts.
How to Mitigate CVE-2024-34717
Immediate Actions Required
- Upgrade all PrestaShop 8.1.5 (and earlier vulnerable) installations to version 8.1.6 or later without delay.
- Audit web server logs for prior anonymous access to invoice download endpoints and identify potentially exposed customers.
- Notify affected customers in accordance with applicable data-protection regulations if invoice exposure is confirmed.
Patch Information
PrestaShop released the fix in PrestaShop Release 8.1.6. The patch enforces proper validation of the secure_key parameter on invoice download requests. Details are documented in the GitHub Security Advisory GHSA-7pjr-2rgh-fc5g.
Workarounds
- No official workarounds are available from the vendor; upgrading to 8.1.6 is the only supported remediation.
- As a temporary compensating control, restrict access to the invoice download route at the web server or WAF layer until the patch is applied.
- Enforce rate limiting on front-office endpoints to slow enumeration attempts against invoice identifiers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
