Server-Side Request Forgery through image URLs in the CSV import

Server-Side Request Forgery through image URLs in the CSV import

Impact

This is a Server-Side Request Forgery (SSRF) issue in the back-office import feature.

When products are imported from a CSV file, the shop server downloads each image address listed in the file. Those addresses were not checked, so the server would fetch whatever it was pointed at, leading to potential escalation to arbitrary code.

The feature requires a back-office employee with the import permission, so a privileged account is needed

Patches

Upgrade to 9.1.5 or 8.2.8

Workarounds

The exposure can be reduced substantially without upgrading:

• Restrict the import feature — remove the import permission from profiles that do not need it, and only import files from a source you trust.
• Filter outbound traffic so the web server cannot reach your private network or your cloud provider's metadata service.

References

• CWE-918: Server-Side Request Forgery
• CWE-502: Deserialization of Untrusted Data
• OWASP: Server Side Request Forgery Prevention Cheat Sheet

_Credits: this vulnerability was responsibly reported to the PrestaShop security team by lrui1 (https://github.com/lrui1). We thank them for their detailed report and proof of concept, and for coordinating the disclosure with us.