CERT/CC has published a vulnerability note on 11 unpatched flaws in Thelia, an open-source e-commerce platform. Seven of them can lead to remote code execution by an authenticated back-office user. No patch exists, because CERT/CC could not coordinate the disclosure with the vendor.
CERT/CC Note VU#162329 Details Seven Remote Code Execution Paths in Thelia
The note, tracked as VU#162329, lists 11 vulnerabilities in total. Seven allow an authenticated back-office user to execute code on the server. CERT/CC said it was “unable to coordinate these vulnerabilities with Thelia, and a patch is not yet available.”
The note was published on October 12. No exploitation or public proof-of-concept has been confirmed.
Upload Checks, Module Installer and Template Editor Open the Code Execution Routes
The seven code execution paths come from several parts of the back office:
- Weak file-upload validation
- A module installer that runs bundled code
- Code injection through the template editor
- Code injection through the translation editor
Each requires an authenticated account in the administrative interface, but once that access exists, the flaws give the attacker control of the web server at the privilege level of the web-server process.
The module installer is a notable entry on the list because it executes code bundled with a module, so installing a malicious module is enough to run an attacker’s code. The template and translation editors fail in a similar way: content entered in those editors can carry injected code that the server then executes. Together they show that several features designed for store customization double as code execution routes when an attacker holds an admin account.
Stored and Reflected XSS Threaten Admin Sessions
The remaining flaws are lower in impact but still relevant to store operators. Stored and reflected cross-site scripting issues can allow an attacker to hijack an administrator’s session. Combined with the code execution paths, a stolen admin session could become a route to a full server compromise.
An admin username enumeration weakness on the login page lets an attacker confirm which usernames exist, and an open redirect can send visitors to phishing pages.
Attackers With an Admin Account Could Reach Customer and Order Data
The primary risk is full server takeover with web-server privileges for an attacker who holds an admin account. A compromised store server places customer and order data at risk.
The vulnerabilities depend on authentication, so the first barrier is account security for the back office. The enumeration flaw makes that barrier weaker, because it narrows the guesswork an attacker needs before attempting to log in, and the XSS issues offer a way to take over an existing session rather than guess credentials.
No Vendor Patch, So CERT/CC Points to Access Restrictions
Because no patch exists, CERT/CC’s advice centers on reducing exposure. It recommends restricting access to Thelia admin interfaces and limiting the use of file-upload and template-editing features. These measures target the exact functions behind the code execution routes, so they remove the most dangerous paths even without a fix.
Why the Missing Vendor Contact Changes the Outlook for Thelia Users
The note’s wording about being unable to coordinate with Thelia matters for store operators. In a coordinated disclosure, a vendor typically has a fix ready when details go public. Here, the details are public while the fix is not, and the only defensive options are configuration-level controls.
The information in this report comes from a single report on the CERT/CC note. Thelia operators should read VU#162329 directly for the full list of weaknesses and monitor for any vendor response. Until a patch arrives, the practical exposure depends on who holds back-office accounts and how reachable the admin interface is from the internet.
