CVE-2024-6648: Ap Pagebuilder Path Traversal Vulnerability

CVE-2024-6648 Overview

CVE-2024-6648 is an absolute path traversal vulnerability [CWE-22] affecting Apollotheme AP Page Builder versions prior to 4.0.0, a module commonly deployed on PrestaShop e-commerce sites. An unauthenticated remote attacker can modify the product_item_path value within the module's config JSON file. This modification allows the attacker to read arbitrary files on the underlying server. The flaw exposes sensitive data, including configuration files, credentials, and source code, without any authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on affected PrestaShop servers running AP Page Builder, leading to disclosure of credentials, configuration, and source code.

Affected Products

Apollotheme AP Page Builder versions prior to 4.0.0
PrestaShop installations using the vulnerable AP Page Builder module
Deployments referenced by CPE cpe:2.3:a:apollotheme:ap_pagebuilder:*:*:*:*:*:prestashop:*:*

Discovery Timeline

2025-05-08 - CVE-2024-6648 published to NVD
2025-05-13 - Last updated in NVD database

Technical Details for CVE-2024-6648

Vulnerability Analysis

The vulnerability resides in how AP Page Builder processes the product_item_path parameter stored in its config JSON file. The module accepts a fully qualified absolute path and uses it as a file reference without validating that the path remains within the expected module directory. Because the path is treated as user-controllable input, an attacker can substitute any filesystem location accessible to the web server process. The module then reads the targeted file and exposes its contents through the rendering flow. The issue is reachable over the network and requires no authentication, no privileges, and no user interaction.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. AP Page Builder does not canonicalize the product_item_path value or constrain it to an allow-listed base directory. Absolute paths such as /etc/passwd or PHP configuration files are accepted verbatim, bypassing any intended directory boundary.

Attack Vector

An unauthenticated attacker submits a crafted request that updates the product_item_path field within the module's config JSON. On subsequent requests, the module dereferences the attacker-supplied path and returns the file contents in the response. Targets typically include /etc/passwd, PrestaShop's config/settings.inc.php, web server access logs, and SSH keys belonging to the web user. Disclosure of database credentials from PrestaShop configuration files frequently enables follow-on compromise of the e-commerce database.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog. See the INCIBE Security Notice for additional technical context.

Detection Methods for CVE-2024-6648

Indicators of Compromise

Unexpected modifications to the AP Page Builder config JSON file, particularly changes to the product_item_path value pointing outside the module directory.
HTTP requests to AP Page Builder endpoints containing absolute paths such as /etc/passwd, /proc/self/environ, or references to PrestaShop's config/settings.inc.php.
Web server responses returning content that does not match expected product imagery or HTML output from the module.

Detection Strategies

Inspect HTTP request bodies and query strings reaching AP Page Builder for path traversal patterns including absolute filesystem paths and ../ sequences.
Monitor file integrity on the AP Page Builder module directory, alerting on writes to JSON configuration files outside scheduled administrative activity.
Correlate web access logs with anomalous response sizes from AP Page Builder endpoints to identify file disclosure attempts.

Monitoring Recommendations

Enable verbose access logging on the PrestaShop front-end and ship logs to a centralized analytics platform for retention and search.
Alert on read access by the web server user to sensitive files such as /etc/passwd, /etc/shadow, and PrestaShop credential files.
Track outbound requests from the PrestaShop host that follow suspicious file reads, as attackers commonly exfiltrate disclosed credentials.

How to Mitigate CVE-2024-6648

Immediate Actions Required

Upgrade AP Page Builder to version 4.0.0 or later on all PrestaShop instances running the module.
Audit the AP Page Builder config JSON file and restore the product_item_path value to its expected default if tampering is detected.
Rotate any credentials stored in PrestaShop configuration files, including database passwords and API keys, if exposure is suspected.
Review web server access logs for prior exploitation attempts referencing absolute paths or sensitive system files.

Patch Information

Apollotheme addresses the vulnerability in AP Page Builder 4.0.0. Administrators should obtain the updated module from the official Apollotheme distribution channel and apply it through the standard PrestaShop module update process. Verify the module version after installation through the PrestaShop back office. Consult the INCIBE Security Notice for vendor-coordinated disclosure details.

Workarounds

Restrict write access to the AP Page Builder config JSON file at the filesystem level until the patch can be applied.
Deploy web application firewall rules that block requests containing absolute paths or path traversal sequences targeting AP Page Builder endpoints.
Temporarily disable the AP Page Builder module in PrestaShop if patching cannot be completed promptly.

bash

# Configuration example: WAF rule sketch and file permission hardening
# 1. Restrict write access to the module config file
chown root:www-data /path/to/prestashop/modules/appagebuilder/config/*.json
chmod 640 /path/to/prestashop/modules/appagebuilder/config/*.json

# 2. Example ModSecurity rule to block absolute paths in requests to the module
SecRule REQUEST_URI "@contains /modules/appagebuilder" \
  "chain,deny,status:403,id:1006648,msg:'CVE-2024-6648 path traversal attempt'"
  SecRule ARGS|REQUEST_BODY "@rx (?:^|[\"'=])/(?:etc|proc|var|root|home)/" "t:none"