How to Fix the PrestaShop Module Vulnerability Related to PHPUnit

A major security flaw has been discovered on PrestaShop that could impact several modules.

A major security flaw was recently identified on the PrestaShop platform, raising concerns about the security of numerous modules. This critical vulnerability could allow malicious actors to create harmful files within online stores, thereby opening the door to a complete takeover of the site.

The origin of this security flaw lies in a vulnerability related to a testing tool called PHPUnit, which should not normally be present on PrestaShop modules. However, it appears that this tool was mistakenly introduced into certain modules, thereby exposing them to considerable security risks.

This issue should not be taken lightly, as it could potentially affect all online stores running on PrestaShop. In response to this imminent threat, urgent measures are needed to prevent potential attacks.

As security is our absolute priority, we want to inform you quickly of this critical flaw. Immediate action has already been taken to secure clients hosted with 772424.com, but it’s essential that all PrestaShop users also take appropriate measures to protect their online stores against this potential threat.

To resolve this issue, there are therefore two possible scenarios:

1 – You are hosted by 772424.com

To address this critical situation, we have identified two possible scenarios to ensure the security of your online store:

1. If you are hosted by 772424.com:
   • In response to this threat, our team took urgent action starting Monday morning to remove the /vendor/phpunit folder from potentially affected modules. This immediate action ensures your store is protected against any exploitation of this vulnerability.
   • Going beyond this measure, the 772424.com team is currently working on setting up a new monitoring probe. This probe will be tasked with automatically detecting the presence of the problematic folder in future installations, thereby strengthening our security vigilance.
2. If you are not hosted by 772424.com:
   • It’s essential that you carry out a thorough check of your online store to determine whether any modules are affected by this security flaw. If you have a managed hosting agreement with your host, we recommend working with them to draw up a list of modules that may be vulnerable.
   • For online store owners without a managed hosting agreement, or those who want to act quickly through Profileo, we offer an urgent corrective solution for just 1 time credit, equivalent to one hour of dedicated intervention.
   • You also have the option of checking for yourself whether the vulnerability is present in your store. To do this, you’ll need to examine all the modules in the /modules/ folder, looking for the /vendor/phpunit/ folder. If it’s found, it must be removed immediately to eliminate the potential risk.

We are committed to guiding you through these crucial steps to ensure the security of your online store, whether you’re hosted by 772424.com or not. Protecting your e-commerce site is our priority, and we’re ready to act diligently to prevent any security risk.

What happens next?

Updates to PrestaShop modules are currently underway, with many vendors planning to follow suit very soon. However, it’s essential to remain constantly vigilant, even after these updates. We strongly recommend that you continue to pay close attention to the integrity of your modules going forward, in particular by checking that no /vendor/phpunit folder is present.

In addition to this approach, it’s worth noting that a more comprehensive solution is available to ensure the security of your online store through the Security Pack. This extended service offers you complete protection against vulnerabilities and potential threats that could affect your e-commerce site.

If you have any doubts about the integrity of your site, or if you’d like to be certain that no known security flaw is present on your store, don’t hesitate to contact our team. You can use the form below to share your concerns and security needs with us. We’re here to support you and to help ensure your e-commerce site remains protected against potential threats. Your peace of mind is our absolute priority 😉

PLEASE NOTE: an official communication from PrestaShop is underway.

Image by Darwin Laganzon from Pixabay