oka Posted July 12, 2013 Share Posted July 12, 2013 Hi. View online: http://demo-store.prestashop.com/en/ * Advisory ID: PRESTASHOP * Version: 1.5.4 * Date: 2013-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- With this vulnerability, account passwords and mail adresses could be modified and also products could be added or removed remotely from the shopping cart. -------- SOLUTION ------------------------------------------------------------ There is no solution for this vulnerability at the moment. -------- REPORTED BY --------------------------------------------------------- * EntPro Cyber Security Research Group (www.entpro.com.tr) (Eyüp ÇELÝK, Ýsmail SAYGILI, Gökay BEKÞEN, Ünlü AÐYOL, Yunus Emre KARABULUT) -------- EXPLOIT CODE --------------------------------------------------------- <html> <head> <body> <img src="http://localhost/language/cart?add=&id_product=[Product ID]" width=0 height=0> </body> </head> </html> http://packetstormse...om/files/122366 Regards Link to comment Share on other sites More sharing options...
nadie Posted July 12, 2013 Share Posted July 12, 2013 Thanks for the information. It looks like a very serious issue. Have you reported the problem to Prestashop team? Sorry for my English Link to comment Share on other sites More sharing options...
nadie Posted July 12, 2013 Share Posted July 12, 2013 Try to report it at: http://forge.prestashop.com/ Thanks ! Sorry for my English. Link to comment Share on other sites More sharing options...
oka Posted July 12, 2013 Author Share Posted July 12, 2013 just saw it on packetstorm... Be careful when you click in a link (or see an image) while you are logged in to BO. Regards Link to comment Share on other sites More sharing options...
Rémi Gaillard Posted July 12, 2013 Share Posted July 12, 2013 Hi Everyone, I want to reassure you all. We take security issues seriously and we have looked very carefully this report. There is CSRF protection in PrestaShop since the beginning, mandatorily in the BackOffice (i think that all of you have seen the token argument in the URL) and optional but activate by default on the FrontOffice. These CSRF protections are working well on the FrontOffice as well as on the BackOffice. I confirm to you all that the content of this disclose is totally false, there is no way to modify address, accounts or anything else. For more information about CSRF you can look this article on wikipedia: http://en.wikipedia....request_forgery Best Regards, 1 Link to comment Share on other sites More sharing options...
nadie Posted July 12, 2013 Share Posted July 12, 2013 Hi Everyone, I want to reassure you all. We take security issues seriously and we have looked very carefully this report. There is CSRF protection in PrestaShop since the beginning, mandatorily in the BackOffice (i think that all of you have seen the token argument in the URL) and optional but activate by default on the FrontOffice. These CSRF protections are working well on the FrontOffice as well as on the BackOffice. I confirm to you all that the content of this disclose is totally false, there is no way to modify address, accounts or anything else. For more information about CSRF you can look this article on wikipedia : http://en.wikipedia....request_forgery Best Regards, Thanks for the information. I was really worried when I read this topic in the forum. Sorry for my English Link to comment Share on other sites More sharing options...
oka Posted July 13, 2013 Author Share Posted July 13, 2013 Hi Everyone, I want to reassure you all. We take security issues seriously and we have looked very carefully this report. There is CSRF protection in PrestaShop since the beginning, mandatorily in the BackOffice (i think that all of you have seen the token argument in the URL) and optional but activate by default on the FrontOffice. These CSRF protections are working well on the FrontOffice as well as on the BackOffice. I confirm to you all that the content of this disclose is totally false, there is no way to modify address, accounts or anything else. For more information about CSRF you can look this article on wikipedia: http://en.wikipedia....request_forgery Best Regards, Rémi Gaillard your words give us peace of mind. Regards. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now