CVE-2024-34990: PrestaShop Help Desk Module RCE Flaw

CVE-2024-34990 Overview

CVE-2024-34990 is a critical unrestricted file upload vulnerability affecting the "Help Desk - Customer Support Management System" (helpdesk) module up to version 2.4.0 from FME Modules for PrestaShop. The vulnerability allows authenticated customers to upload arbitrary .php files through the ticket submission and reply functionality, potentially leading to remote code execution on the target server.

Critical Impact

This vulnerability enables authenticated attackers to upload malicious PHP files to a predictable server path, allowing complete server compromise through remote code execution.

Affected Products

• Help Desk - Customer Support Management System (helpdesk) module versions up to 2.4.0
• PrestaShop installations using the vulnerable FME Modules helpdesk module

Discovery Timeline

• 2024-06-19 - CVE-2024-34990 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-34990

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The helpdesk module fails to properly validate and restrict the file types that can be uploaded when customers interact with the support ticket system. Two specific controller methods are affected: HelpdeskHelpdeskModuleFrontController::submitTicket() and HelpdeskHelpdeskModuleFrontController::replyTicket().

These methods allow customers to attach files to their support tickets or replies without adequate file type verification. An attacker with a valid customer account can exploit this flaw to upload PHP files containing malicious code. Once uploaded, these files are stored in a predictable location on the server, making them easily accessible for execution.

Root Cause

The root cause of this vulnerability lies in the insufficient file upload validation within the helpdesk module's front-end controller. The submitTicket() and replyTicket() methods do not implement proper file extension filtering or content-type verification, allowing dangerous file types such as .php to be uploaded. Additionally, the upload path is predictable, which means an attacker can easily determine where their malicious file will be stored and subsequently access it to trigger code execution.

Attack Vector

The attack vector is network-based and requires low complexity to exploit. An attacker needs valid customer credentials to authenticate to the PrestaShop store. Once authenticated, the attacker can:

1. Navigate to the helpdesk module's ticket submission or reply interface
2. Craft a malicious PHP file containing a web shell or other payload
3. Upload the PHP file as an attachment through the vulnerable methods
4. Access the uploaded file directly via its predictable path
5. Execute arbitrary code on the server with the web server's privileges

The vulnerability allows for changed scope, meaning successful exploitation can affect resources beyond the vulnerable component itself, potentially compromising the entire server and any other applications hosted on it. For technical details on exploitation methods, refer to the Friends of Presta Security Advisory.

Detection Methods for CVE-2024-34990

Indicators of Compromise

• Presence of unexpected .php files in helpdesk upload directories
• Web server logs showing requests to PHP files in attachment/upload paths
• Unusual outbound network connections from the web server process
• Modified system files or new user accounts created on the server

Detection Strategies

• Monitor file system events for .php file creation in the helpdesk module's upload directories
• Implement web application firewall (WAF) rules to block PHP file uploads to known attachment endpoints
• Review web server access logs for requests to unusual paths within the helpdesk module structure
• Deploy file integrity monitoring on critical PrestaShop directories

Monitoring Recommendations

• Enable detailed logging for all file upload operations in PrestaShop
• Configure alerts for any executable file types uploaded through the helpdesk module
• Implement real-time monitoring of web server access patterns for anomalous behavior
• Regularly audit customer-submitted files and attachments for suspicious content

How to Mitigate CVE-2024-34990

Immediate Actions Required

• Update the Help Desk module to a version newer than 2.4.0 that addresses this vulnerability
• If an immediate update is not possible, disable the helpdesk module until a patch can be applied
• Review existing uploaded files in the helpdesk attachment directories for any malicious PHP files
• Implement server-side controls to prevent PHP execution in upload directories

Patch Information

Users should update the FME Modules "Help Desk - Customer Support Management System" module to a version that properly validates file uploads and prevents the upload of dangerous file types. Consult the Friends of Presta Security Advisory for specific remediation guidance and patch details.

Workarounds

• Add .htaccess rules to the upload directory to prevent PHP execution
• Implement file extension whitelisting at the web server level for upload directories
• Configure ModSecurity or similar WAF to block PHP file uploads to helpdesk endpoints
• Restrict network access to the PrestaShop admin and helpdesk interfaces to trusted IP ranges

# Example .htaccess configuration to prevent PHP execution in upload directories
# Place this in the helpdesk module's upload directory
<FilesMatch "\.php$">
    Deny from all
</FilesMatch>

# Alternative using Apache 2.4+ syntax
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>