External risk intelligence

Ecommerce-CodeIgniter-Bootstrap Remote Code Execution via removeSecondaryImage

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-31823

This vulnerability exists in an e-commerce application platform. E-commerce platforms are typically deployed as public-facing web applications intended to be accessible to customers over the internet to facilitate online shopping, making the underlying code base and its components commonly exposed to the public internet.

Code Injection

Ecommerce Codeigniter Bootstrap Project Ecommerce Codeigniter Bootstrap

2024-01-02

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in an e-commerce platform component, potentially allowing unauthorized remote execution of arbitrary code. This issue stems from a flaw in the `removeSecondaryImage` method of the Publish.php file. The broad accessibility of e-commerce platforms suggests a significant exposure risk that warrants attention.

Remote code execution flaw in e-commerce software.
Critical flaw could impact public-facing applications.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker can exploit this vulnerability by sending a crafted request to a public-facing e-commerce application. This request targets the `Publish.php` component, specifically the `removeSecondaryImage` method, which is vulnerable to arbitrary code execution. Successful exploitation could allow the attacker to run any code on the server.

No authentication or user interaction needed.
Triggered by calling `removeSecondaryImage` method.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code on a system running the affected software through the `removeSecondaryImage` method. This could impact the integrity and availability of the e-commerce platform and any data it manages.

System data and service integrity.
Remote code execution via method.
Compromise of application and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Ecommerce-CodeIgniter-Bootstrap project's `Publish.php` component is susceptible to remote code execution. Application owners and platform teams are likely responsible for managing this technology. The first practical step is to locate all instances of this software, assess their exposure and business criticality, and then identify the accountable owner to plan remediation based on the identified risk.

Identify accountable application owners.
Verify system reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ecommerce-CodeIgniter-Bootstrap?

It is an open-source web application platform built on the CodeIgniter framework designed for managing online store operations. Users typically deploy it to handle product catalogs, customer interactions, and e-commerce transactions, making it the foundational infrastructure for an online storefront.

What does CVE-2024-31823 mean?

This CVE identifies a critical security flaw classified as CWE-94, or Improper Control of Generation of Code. In plain English, the application fails to properly sanitize inputs, allowing an attacker to inject and execute their own unauthorized commands or scripts directly on the server hosting the software.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specifically crafted request to the Publish.php component, targeting the removeSecondaryImage method. It is important to note that the vulnerability does not require the attacker to have an account, nor does it require any specific interaction from a legitimate user to execute.

Is my system at risk?

According to Halo Surface Signal, this software is often used for e-commerce platforms that are intentionally placed on the public internet to reach customers. Because of this common deployment pattern, your risk is significantly higher if your instance of the application is internet-facing rather than hidden behind a secure, internal-only network.

What should I do if I use this software?

Start by performing an inventory to locate every instance of the software within your environment. Once identified, evaluate the business criticality and network reachability of each instance. Coordinate with the relevant application owners to assess the risk and prioritize a security update or remediation plan to prevent unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.