Authenticated Administrator RCE via Smarty Template Injection in Thelia 2.6.0

Executive Summary

Thelia 2.6.0 uses Smarty for email templates without restricting access to dangerous PHP functions. An authenticated admin can inject malicious Smarty expressions into email templates via the messages configuration interface. When rendered, functions like system(), exec(), file_put_contents(), and file_get_contents() can be executed with web process privileges, enabling arbitrary OS command execution, file read/write, and remote code execution on the server.

Useful 0 Not Useful 0

Detection Guidance

Check Thelia admin email template configurations for unauthorized Smarty expressions containing PHP functions like system(), exec(), file_put_contents(), or file_get_contents(). Review template preview logs for unexpected command execution or file operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with admin access to execute arbitrary commands on the server, read or write files, and potentially gain full control of the system. It compromises confidentiality, integrity, and availability of data and services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access, potential data breaches, and lack of proper access controls. It undermines data protection and security measures required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Thelia to a patched version if available. Restrict admin access to email template editing. Disable dangerous Smarty functions in email templates. Monitor for unauthorized file changes or command execution.

Useful 0 Not Useful 0