CVE-2024-6524: ShopXO Server-Side Request Forgery Vulnerability
Summary
CVE-2024-6524: ShopXO Server-Side Request Forgery Vulnerability. Affects shopxo/shopxo versions < 6.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ShopXO is an open-source e-commerce platform built with PHP. It provides various features for creating and managing online stores. The vulnerability affects versions up to 6.1.0 of the ShopXO package. It is a critical vulnerability that allows for server-side request forgery (SSRF) through the manipulation of the 'source' argument in the 'extend/base/Uploader.php' file. This vulnerability can be exploited remotely and has been publicly disclosed.
Vulnerability Detail
The ShopXO Server-Side Request Forgery vulnerability (CVE-2024-6524) arises from a flaw in the 'Uploader.php' file. By manipulating the 'source' argument, an attacker can trick the server into making arbitrary requests on their behalf, potentially leading to unauthorized access to internal resources or performing actions on behalf of the server. This vulnerability has been rated as moderate severity with a CVSS score of 5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can modify the 'Uploader.php' file to validate and sanitize the 'source' argument before processing it. Here is an example of how the code can be modified:
// Add the following code snippet at the beginning of the 'Uploader.php' file
if (!filter_var($source, FILTER_VALIDATE_URL)) {
// Handle invalid URL
exit('Invalid URL');
}
// Rest of the code
// ...
This workaround validates the 'source' argument to ensure it is a valid URL before proceeding with the request. However, it is strongly recommended to apply the official patch by updating the package to the latest version.
Conclusion
The ShopXO Server-Side Request Forgery vulnerability (CVE-2024-6524) is a critical security issue that allows for unauthorized access to internal resources or performing actions on behalf of the server. It affects versions up to 6.1.0 of the ShopXO package. Users are advised to update to version 6.1.1 or later to mitigate the risk of exploitation. In the meantime, a temporary workaround is available by validating and sanitizing the 'source' argument in the 'Uploader.php' file.
See every vulnerability recorded for shopxo/shopxo →
FAQ
The vulnerability allows an attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to internal resources or performing actions on behalf of the server.
Yes, this vulnerability can be exploited remotely.
This vulnerability has been rated as moderate severity with a CVSS score of 5.5.
Yes, the vulnerability has been publicly disclosed.
To fix this vulnerability, update the ShopXO package to version 6.1.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for shopxo/shopxo.
