Prestashop 8.0.4 - Cross-Site Scripting (XSS)

PrestaShop 8.0.4 Cross-Site Scripting (XSS) Vulnerability: A Deep Dive into Stored XSS Exploitation

Security researchers have recently uncovered a critical stored Cross-Site Scripting (XSS) vulnerability in PrestaShop 8.0.4, a widely used open-source e-commerce platform. This flaw allows attackers to inject malicious scripts into the application through seemingly benign file uploads, potentially compromising user sessions, stealing sensitive data, and executing arbitrary code on behalf of authenticated users.

Understanding the Vulnerability: Stored XSS in PrestaShop 8.0.4

Stored XSS occurs when malicious scripts are permanently saved on the server and later executed whenever a user accesses the affected page. Unlike reflected XSS, which requires a crafted URL, stored XSS persists across sessions and can affect multiple users, making it particularly dangerous.

In the case of PrestaShop 8.0.4, the vulnerability lies in the file upload functionality within the admin interface, specifically in the /admin253irhit4jjbd9gurze/filemanager/upload.php endpoint. This endpoint allows administrators to upload files, including images, for product listings. However, the platform fails to properly sanitize or validate SVG (Scalable Vector Graphics) files before storing them.

Exploitation Technique: Malicious SVG Injection

Attackers can exploit this vulnerability by uploading a specially crafted SVG file containing embedded JavaScript. SVG files are designed to be visually rich and often include scripting capabilities via the <script> tag. When the file is uploaded and stored, the script remains intact—unfiltered and unescaped—until it is rendered in the browser.

 
 
      alert(document.location);
   

Explanation: This SVG file contains a harmless visual element (a green triangle) and a JavaScript script that triggers an alert() when the SVG is rendered. While this example is benign for demonstration purposes, in real-world exploitation, the script could:

• Steal cookies or session tokens via document.cookie.
• Redirect users to phishing sites.
• Execute malicious actions on the user’s behalf (e.g., changing password, making purchases).
• Exfiltrate data to external servers using fetch() or XMLHttpRequest.

Attack Vector: File Upload via Admin Interface

The attack path is straightforward:

1. Log in as an administrator (or attacker with admin privileges).
2. Navigate to Catalog → Products.
3. Select any product and upload the malicious SVG file via the file manager.
4. After upload, the file is stored in the server’s media directory.
5. When the product page is viewed by any user (especially admin or customer), the SVG is rendered in the browser.
6. The embedded script executes, enabling the attacker to perform actions on the victim’s browser.

Technical Analysis: Why SVG Files Are a Risk Vector

SVG is a powerful format that supports scripting and event handling. While intended for graphics, it can be abused due to its flexibility. PrestaShop 8.0.4 does not implement proper file type validation or script sanitization when handling SVG uploads. This oversight stems from:

• Over-reliance on MIME type checks without content inspection.
• Failure to parse and filter embedded scripts in SVG files.
• Missing input validation for <script> tags in XML-based files.

Even though SVG files are not traditionally considered executable, their ability to embed JavaScript via <script> tags makes them a prime vector for XSS attacks—especially when uploaded by administrators.

Impact and Risk Assessment

Severity	High
Attack Complexity	Low (requires admin access)
Exploitability	High (persistent, automated)
CVSS Score	8.3 (CVSS v3.1: High severity)

While the vulnerability requires administrative access, it can lead to:

• Session hijacking through cookie theft.
• Privilege escalation if scripts manipulate admin panels.
• Defacement of product pages with malicious content.
• Phishing via redirect scripts.
• Command execution in user context, especially if combined with other vulnerabilities.

Real-World Use Case: A Breach Scenario

Imagine an attacker with access to a PrestaShop admin panel:

1. Uploads an SVG file with a script that reads document.cookie and sends it to a remote server.
2. Later, when a customer visits the product page, the script executes.
3. The attacker receives the user’s session cookie.
4. Using the stolen cookie, the attacker logs in as the customer and makes unauthorized purchases.

This demonstrates how stored XSS can be used to bridge the gap between server-side vulnerabilities and client-side exploitation.

Best Practices & Mitigation Strategies

To prevent such attacks, administrators and developers must adopt a multi-layered security approach:

• Disable SVG uploads unless absolutely necessary, and restrict file types to safe formats (e.g., PNG, JPEG).
• Implement strict file validation using both MIME type and content inspection (e.g., using libxml to parse SVG files).
• Sanitize all embedded scripts in SVG files—remove or disable <script> tags during upload.
• Use Content Security Policy (CSP) headers to block inline scripts and restrict script sources.
• Enable logging for file uploads to detect suspicious patterns.
• Regularly update PrestaShop to patched versions (e.g., 8.0.5 or later).

Corrected Code Example: Secure SVG Upload Validation

// Example: Server-side validation before storing SVG files
function validate_svg_file($file_path) {
    $xml = simplexml_load_file($file_path);
    if ($xml === false) {
        return false; // Invalid XML
    }

    // Check for script tags
    $scripts = $xml->xpath('//script');
    if (!empty($scripts)) {
        return false; // Script detected
    }

    // Check for dangerous attributes (e.g., onload, onclick)
    $dangerous_attrs = $xml->xpath('//@onload | //@onclick');
    if (!empty($dangerous_attrs)) {
        return false; // Dangerous attributes found
    }

    return true; // Safe file
}

Explanation: This function uses PHP’s simplexml_load_file to parse the SVG file and checks for <script> tags or dangerous event attributes. If any are found, the upload is rejected. This ensures that even if an SVG file is uploaded, it won’t contain executable code.

Conclusion: A Reminder for E-Commerce Security

While PrestaShop is a robust platform, vulnerabilities like stored XSS in 8.0.4 underscore the importance of continuous security audits, input validation, and defense-in-depth strategies. Administrators should never assume that file uploads are harmless—especially when they support complex formats like SVG.

Security is not a one-time fix but an ongoing process. Patching vulnerabilities, validating inputs, and implementing CSP policies are essential steps to protect online stores from modern web threats.</p