Packagist · prestashop/ps_facetedsearch
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
A PHP Object Injection vulnerability affects the PrestaShop module ps_facetedsearch.
The module rebuilds the selected search filters from the request URL. The value of a slider filter (price or weight) is taken from the URL without sufficient validation, then stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize().
By crafting that value, an attacker can smuggle a malicious serialized PHP object into the cache. When it is deserialized, a gadget chain writes an arbitrary PHP file inside the module directory, which is then used as a webshell to run commands on the server.
Any shop using a vulnerable version of ps_facetedsearch that displays a filter template containing a slider filter (price or weight). Exploitation is remote and unauthenticated, a single crafted front-office request is enough, and leads to remote code
execution and full compromise of the shop and its server.
Affected versions: 3.0.0 through 4.0.3 (all versions since 3.0.0, including the latest release).
Upgrade the ps_facetedsearch module to the patched version. Upgrading the module is the best action that removes the vulnerability.
Otherwise, you can apply the fix manually in the file src/Filters/Block.php:
In the getFromCache() method, replace the native unserialize() call:
// Before
if (!empty($row)) {
return unserialize(current($row));
}
// After
if (!empty($row)) {
return \Tools::unSerialize(current($row));
}
modules/ps_facetedsearch/ directory for
unexpected PHP files.O:, ;i:, references to classes such
as Monolog\…) and block them at the WAF level.Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.