Summary
A PHP object injection vulnerability in PrestaShop's ps_facetedsearch module allows crafted slider filter values in URLs to be cached and later processed with native unserialize(), enabling execution of a gadget chain.
An unauthenticated attacker can use this path to write a malicious PHP file into the module directory and turn it into a webshell, leading to full command execution on the server when layered navigation filters are rebuilt from request data.
A PHP object injection vulnerability in PrestaShop's ps_facetedsearch module allows crafted slider filter values in URLs to be cached and later processed with native unserialize(), enabling execution of a gadget chain.
An unauthenticated attacker can use this path to write a malicious PHP file into the module directory and turn it into a webshell, leading to full command execution on the server when layered navigation filters are rebuilt from request data.
Affected context
The vulnerability occurs in PrestaShop installations that use the ps_facetedsearch module versions 3.0.0 through 4.0.4, where layered navigation filters (such as price or weight sliders) are reconstructed from user-controlled URL parameters.
In these versions, slider values are copied into an internal filter-block cache without robust validation and later fed into PHP's unserialize() in src/Filters/Block.php.
The issue is present when request-derived filter data is stored and reused as serialized objects, and the module assumes that cached data remains trustworthy across requests.
The vulnerability occurs in PrestaShop installations that use the ps_facetedsearch module versions 3.0.0 through 4.0.4, where layered navigation filters (such as price or weight sliders) are reconstructed from user-controlled URL parameters.
In these versions, slider values are copied into an internal filter-block cache without robust validation and later fed into PHP's unserialize() in src/Filters/Block.php.
The issue is present when request-derived filter data is stored and reused as serialized objects, and the module assumes that cached data remains trustworthy across requests.
Exploit preconditions
- Attack surface: Public-facing PrestaShop storefront pages that expose ps_facetedsearch layered navigation (e.g., category or product listing pages).
- Required access: No authentication required; an attacker only needs the ability to send crafted HTTP requests with manipulated slider filter parameters (price, weight, or similar).
- Trigger point: The module rebuilds filter blocks from the request URL, stores user-supplied slider values in the cache, and later reads them back using raw native unserialize() in src/Filters/Block.php.
- Why exploitation is possible: The system treats unvalidated, user-controlled slider values as trusted serialized data, enabling a malicious PHP object payload to be smuggled into the cache and deserialized in a context where gadget classes can perform file writes.
- Attack surface: Public-facing PrestaShop storefront pages that expose ps_facetedsearch layered navigation (e.g., category or product listing pages).
- Required access: No authentication required; an attacker only needs the ability to send crafted HTTP requests with manipulated slider filter parameters (price, weight, or similar).
- Trigger point: The module rebuilds filter blocks from the request URL, stores user-supplied slider values in the cache, and later reads them back using raw native unserialize() in src/Filters/Block.php.
- Why exploitation is possible: The system treats unvalidated, user-controlled slider values as trusted serialized data, enabling a malicious PHP object payload to be smuggled into the cache and deserialized in a context where gadget classes can perform file writes.
Why this happens
At its core, this is an unsafe deserialization pattern where user input is allowed to flow into serialized object storage and is later deserialized without integrity or type checks.
The ps_facetedsearch module reconstructs filter blocks from URL parameters, stores the slider values in an internal cache, and later passes them directly to PHP's unserialize(). This violates the principle that serialized data should never be considered trusted when it can be influenced by external input.
Mapped to CWE-74, the vulnerability reflects improper neutralization of crafted values when building data structures that influence downstream behavior, allowing attacker-controlled serialized objects to drive a gadget chain that writes arbitrary PHP files into the module directory. Abstractly, the insecure pattern is: "take user input → store as serialized object → unserialize without validation in a privileged context."
At its core, this is an unsafe deserialization pattern where user input is allowed to flow into serialized object storage and is later deserialized without integrity or type checks.
The ps_facetedsearch module reconstructs filter blocks from URL parameters, stores the slider values in an internal cache, and later passes them directly to PHP's unserialize(). This violates the principle that serialized data should never be considered trusted when it can be influenced by external input.
Mapped to CWE-74, the vulnerability reflects improper neutralization of crafted values when building data structures that influence downstream behavior, allowing attacker-controlled serialized objects to drive a gadget chain that writes arbitrary PHP files into the module directory. Abstractly, the insecure pattern is: "take user input → store as serialized object → unserialize without validation in a privileged context."
Potential impact
- An attacker may create arbitrary PHP files inside the modules/ps_facetedsearch/ directory.
- An attacker could turn the injected PHP file into a webshell, enabling remote command execution on the server.
- An attacker can potentially gain full control over the PrestaShop application and its data.
- An attacker may pivot to compromise the underlying operating system and other services accessible from the compromised host.
- An attacker could modify storefront behavior, steal customer information, or tamper with orders and payment flows.
- An attacker may create arbitrary PHP files inside the modules/ps_facetedsearch/ directory.
- An attacker could turn the injected PHP file into a webshell, enabling remote command execution on the server.
- An attacker can potentially gain full control over the PrestaShop application and its data.
- An attacker may pivot to compromise the underlying operating system and other services accessible from the compromised host.
- An attacker could modify storefront behavior, steal customer information, or tamper with orders and payment flows.
General mitigation guidance
Mitigation generally focuses on ensuring that user-controlled data is never treated as trusted serialized content and that dynamic filter values cannot drive unsafe object creation.
Useful defensive patterns include:
- Avoiding native unserialize() for any data that could originate from or be influenced by URLs, query parameters, cookies, or other external sources.
- Using safer, data-only serialization formats (such as JSON with strict schema validation) for caching filter blocks instead of PHP objects.
- Normalizing and strictly validating slider values (e.g., enforcing numeric ranges, type checks, and rejecting unexpected structures) before storage.
- Designing cache mechanisms so that their contents are derived from sanitized, server-side state rather than directly embedding user input.
- Applying least-privilege principles to file system access in application code, ensuring that modules have no ability to write executable files to web-accessible directories unless strictly necessary.
Mitigation generally focuses on ensuring that user-controlled data is never treated as trusted serialized content and that dynamic filter values cannot drive unsafe object creation.
Useful defensive patterns include:
- Avoiding native unserialize() for any data that could originate from or be influenced by URLs, query parameters, cookies, or other external sources.
- Using safer, data-only serialization formats (such as JSON with strict schema validation) for caching filter blocks instead of PHP objects.
- Normalizing and strictly validating slider values (e.g., enforcing numeric ranges, type checks, and rejecting unexpected structures) before storage.
- Designing cache mechanisms so that their contents are derived from sanitized, server-side state rather than directly embedding user input.
- Applying least-privilege principles to file system access in application code, ensuring that modules have no ability to write executable files to web-accessible directories unless strictly necessary.
How teams detect issues like this
Detection approaches typically revolve around identifying dangerous deserialization flows and unexpected file creation in module directories.
Common strategies include:
- Static analysis rules that flag calls to unserialize() where the source data can be traced back to HTTP request parameters or other external input.
- Code review practices that scrutinize caching logic, particularly where serialized objects are stored and later rehydrated from data influenced by users.
- Application-level logging or monitoring that alerts on unexpected writes of new PHP files under modules/, especially in response to simple browsing or filter changes.
- Runtime security tooling or web application firewalls configured to detect and block serialized object payloads in query strings and other request components.
- Policy-based enforcement in CI pipelines that disallow unsafe serialization/deserialization patterns and require structured data formats with clear schemas for cache storage.
Detection approaches typically revolve around identifying dangerous deserialization flows and unexpected file creation in module directories.
Common strategies include:
- Static analysis rules that flag calls to unserialize() where the source data can be traced back to HTTP request parameters or other external input.
- Code review practices that scrutinize caching logic, particularly where serialized objects are stored and later rehydrated from data influenced by users.
- Application-level logging or monitoring that alerts on unexpected writes of new PHP files under modules/, especially in response to simple browsing or filter changes.
- Runtime security tooling or web application firewalls configured to detect and block serialized object payloads in query strings and other request components.
- Policy-based enforcement in CI pipelines that disallow unsafe serialization/deserialization patterns and require structured data formats with clear schemas for cache storage.
