Critical security vulnerability in PrestaShop modules

Attackers are using a vulnerability in a popular dependency used by modules to take control of PrestaShop sites. For details, please read the entire article.

What’s happening

It has come to our attention that attackers are exploiting a vulnerability in PHPUnit to perform arbitrary code execution in servers running PrestaShop websites. The issue is fixed in PHPUnit 7.5.19 and 8.5.1. To our knowledge, all previous versions are vulnerable, at least for certain server configurations.

How to tell if you are impacted

Connect to your shop via FTP or shell access, and look at the “vendor” directory in the main prestashop folder and inside each one of your modules:

• <prestashop_directory>/vendor
• <prestashop_directory>/modules/<module_name>/vendor

If there’s a directory called “phpunit” inside the aforementioned directories, your shop may be vulnerable.

Warning: don’t touch anything else or you might break your shop Other files and folders (e.g /vendor/symfony/symfony/src/Symfony/Bridge/PhpUnit/ or .xml files) are safe, do not delete them.

What to do if you are impacted

PHPUnit is a development library and is not needed for the normal function of your site, so you can simply delete all the “phpunit” directories found above. This should help close the attack vector.

On a Linux server, this can be performed quickly using the following bash command line from shop’s modules/ folder:

find . -type d -name "phpunit" -exec rm -rf {} \;

This command requires the relevant user rights.

You can also delete “phpunit” folders manually via FTP.

Be aware that even if you perform this cleanup, your shop may have already been compromised.

According to our analysis, most attackers either place new files in the filesystem or modify existing files, like AdminLoginController.php.

Here’s a non-exhaustive list of known malicious files that may indicate a compromised shop:

• XsamXadoo_Bot.php
• XsamXadoo_deface.php
• 0x666.php
• f.php
• Xsam_Xadoo.html

You can check if Core PrestaShop files have been modified by looking at the “List of changed files” section at the bottom of the “Advanced Parameters > Information” page in your Back Office. However, this check may not be enough since your site may have been compromised otherwise.

If your shop has been compromised or if you think it has been compromised:

• Carefully check that the attacker didn’t leave any file on your server, e.g hidden in the middle of your shop files and/or contact an expert to do it for you.
• Consider asking all users of your shop(s) to change their password, which includes back office users but also customer accounts. Make sure no compromised file is still present in your shop before.

If you think your site has been hacked, contact a security expert.

PrestaShop modules impacted by this vulnerability

Some modules are impacted:

• 1-Click Upgrade (autoupgrade): versions 4.0 beta and later
• Cart Abandonment Pro (pscartabandonmentpro): versions 2.0.1~2.0.2
• Faceted Search (ps_facetedsearch): versions 2.2.1~3.0.0
• Merchant Expertise (gamification): versions 2.1.0 and later
• PrestaShop Checkout (ps_checkout): versions 1.0.8~1.0.9

We have released updated versions for these modules which completely remove the related library from their own dependencies:

• 1-Click upgrade: v4.10.1
• Cart Abandonment Pro: v2.0.10
• Faceted Search: v3.4.1
• Merchant Expertise: v2.3.2
• PrestaShop Checkout: v1.2.9

Be aware that if you installed in the past an impacted version of those modules, PHPUnit files may still be present on your server. Only these newly released versions make sure PHPUnit is no longer present in their own vendor directory.

Modules and themes by other vendors may be vulnerable as well. Expect updates to follow soon.

Additional information

A very special thank you to Francis Ladeuil who first reported this issue.

We have also published a post incident analysis that you might want to read.

FAQ

You can find answers to some frequent questions asked these past days.