CVE-2024-34716: PrestaShop cross-site scripting via customer contact form in FO, through file upload
Only PrestaShops with customer-thread feature flag enabled are impacted, starting from PrestaShop 8.1.0.
The impact is substantial, when the customer thread feature flag is enabled, through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office.
Consequence: the script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator’s right.
References
- github.com/PrestaShop/PrestaShop
- github.com/PrestaShop/PrestaShop/commit/a248898655e56cbcc6c308a5f1c8752231624bae
- github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
- github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78
- github.com/advisories/GHSA-45vm-3j38-7p78
- nvd.nist.gov/vuln/detail/CVE-2024-34716
Code Behaviors & Features
Detect and mitigate CVE-2024-34716 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →