Authenticated Admin RCE via Malicious Module Upload in Thelia

Executive Summary

Thelia v2.6.0 allows authenticated administrators to upload and install modules via ZIP upload without validating or sandboxing embedded PHP code. Attackers can include malicious PHP code in a module's install() method, which executes upon installation, leading to remote code execution with the web server's privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Thelia installations for unauthorized module uploads or PHP code execution. Check web server logs for POST requests to /admin/module/import and examine uploaded ZIP files for embedded PHP in install() methods. Use commands like 'find /path/to/thelia -name "*.zip" -exec unzip -l {} \;' to inspect archives.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrator access could exploit this to execute arbitrary code on the server, potentially taking full control of the system, stealing data, or disrupting services. Even with limited access, this could escalate privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Thelia to a version that validates and sandboxes PHP code in uploaded modules. Restrict administrative access to trusted users only. Monitor for unauthorized module installations or PHP execution attempts.

Useful 0 Not Useful 0