CVE-2023-30838 in PrestaShop
Summary
by MITRE • 04/25/2023
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/20/2023
The vulnerability described in CVE-2023-30838 affects PrestaShop, a widely used open-source e-commerce platform that powers millions of online stores worldwide. This security flaw exists in versions prior to 8.0.4 and 1.7.8.9, representing a critical cross-site scripting vulnerability that undermines the platform's security posture. The vulnerability stems from the `ValidateCore::isCleanHTML()` method which fails to properly sanitize HTML content, creating a pathway for malicious actors to inject harmful scripts into the application's output.
The technical flaw specifically involves the inadequate filtering of HTML attributes within the validation process, particularly when dealing with CSS animation properties. The vulnerability exploits the presence of pre-setup `@keyframes` methods that can be manipulated to hijack HTML attributes without requiring any user interaction. This represents a sophisticated attack vector because it leverages CSS animation capabilities to execute malicious code, bypassing traditional XSS protection mechanisms that typically focus on HTML attributes like `onload` or `onerror`. Unlike conventional XSS attacks that are limited to specific event handlers, this vulnerability can target any HTML element within the application's interface, making it exceptionally dangerous.
The operational impact of this vulnerability is severe as it allows attackers to execute malicious scripts automatically when pages are loaded, without requiring user interaction or clicks. This automatic execution capability transforms what would typically be a minor security concern into a critical threat that can compromise both customer data and administrative functions. The vulnerability's scope extends to every HTML element, meaning that an attacker could potentially hijack any part of the application's interface, from product displays to administrative panels. This comprehensive element targeting capability significantly increases the potential damage compared to traditional XSS attacks that are limited to specific attributes or event handlers.
This vulnerability aligns with CWE-79, which describes Cross-Site Scripting vulnerabilities, and demonstrates characteristics consistent with ATT&CK technique T1566.001 for initial access through malicious content. The attack vector specifically exploits the weakness in HTML sanitization and CSS processing, creating a unique threat landscape where CSS animation properties become attack vectors rather than mere presentation elements. Organizations using affected PrestaShop versions face significant risk of data breaches, session hijacking, and potential full system compromise. The fix implemented in versions 8.0.4 and 1.7.8.9 addresses the root cause by properly sanitizing HTML attributes and preventing CSS animation properties from being used as attack vectors. Security professionals should prioritize updating affected systems immediately and conduct thorough security assessments to ensure no malicious code has been injected into compromised environments.