CVE-2021-21308 in PrestaShop
Summary
by MITRE • 02/27/2021
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/14/2021
The vulnerability identified as CVE-2021-21308 affects PrestaShop versions prior to 1.7.7.2, representing a critical security flaw in the e-commerce platform's authentication and authorization mechanisms. This issue specifically targets the soft logout functionality within the system, which is designed to provide a seamless user experience by maintaining certain session states while clearing others. The incomplete implementation of this soft logout mechanism creates a persistent security gap that allows attackers to exploit the system's session management and potentially execute unauthorized customer commands.
The technical flaw resides in how PrestaShop handles session invalidation during the soft logout process. When users perform a soft logout, the system should properly invalidate session tokens and prevent further access to customer-specific functionalities. However, the vulnerability allows attackers to leverage existing session identifiers or manipulate session states to maintain access to customer accounts. This weakness enables unauthorized execution of commands that should only be available to authenticated users, effectively bypassing the intended security boundaries. The flaw operates at the application level and can be exploited through various attack vectors that manipulate session data or exploit timing issues in the logout process.
The operational impact of this vulnerability is significant for e-commerce platforms running affected PrestaShop versions, as it creates an avenue for unauthorized access to customer accounts and their associated data. Attackers can potentially perform actions such as viewing customer information, modifying orders, accessing payment details, or executing other customer-specific operations without proper authentication. This vulnerability directly violates the principle of least privilege and can lead to data breaches, financial losses, and reputational damage for businesses relying on the platform. The impact extends beyond individual user accounts to potentially affect the entire customer base and business operations, particularly in environments where multiple users share the same system infrastructure.
The mitigation strategy for CVE-2021-21308 involves immediate upgrading to PrestaShop version 1.7.7.2 or later, which contains the necessary patches to address the incomplete soft logout implementation. Organizations should also conduct thorough security assessments of their current systems to identify any potential exploitation attempts and implement additional monitoring measures. Security teams should review session management configurations and ensure that proper session invalidation procedures are in place. This vulnerability aligns with CWE-613, which addresses inadequate session management, and could be categorized under ATT&CK technique T1531 for "Account Access Removal" and T1078 for "Valid Accounts" as it involves unauthorized access to customer accounts through session manipulation. Additionally, the issue demonstrates characteristics of privilege escalation and session hijacking attacks that require comprehensive security controls including proper session token handling, secure session management, and regular security updates to prevent exploitation.