Unauthenticated remote code execution in JTL Shop

JTL responded fast and has released fixes for every supported branch: versions 5.5.4, 5.6.2 and 5.7.2, plus a back-patch covering 5.0.0 through 5.7.0. Every store owner running JTL Shop 5.2.0 or later should upgrade immediately.

A CVE is pending.

From data theft to code execution

The impact depends on the installed version.

On JTL Shop 5.2.0 and later, where the SSTI was introduced, an attacker can read server-side values through the injected template. That includes the BLOWFISH_KEY, the database host, name, user and password, and the shop configuration: SMTP and newsletter credentials, FTP and Redis settings, OAuth secrets and the stored SFTP private key.

On JTL Shop 5.4.0 and later, the shop registers unserialize and file_get_contents as Smarty modifiers. An attacker can write a webshell to the web root and execute commands as the web server user.

Affected versions

JTL also published a back-patch covering 5.0.0 through 5.7.0 for installations that cannot move to the latest point release in their branch.

Recommendations

1. Upgrade to JTL Shop 5.5.4, 5.6.2 or 5.7.2, or apply JTL's back-patch for older 5.x installations. See the JTL announcement for download links.
2. Rotate secrets after patching. Because this flaw exposes the Blowfish key, database password and stored credentials, treat them as compromised on any store that ran a vulnerable version exposed to the internet.
3. Run eComscan if you suspect abuse, to detect webshells, backdoors and injected malware.
4. Deploy Sansec Shield to block exploitation attempts in real time.

There is no evidence of active exploitation so far. That can change quickly once a patch points attackers at the vulnerable code, so unpatched stores face rising scanning pressure.

Scaling vulnerability research

This finding is part of a broader Sansec effort. We have been working around the clock to find and triage vulnerabilities in ecommerce platforms, and new AI-assisted research capabilities now let us cover far more code, far faster. Expect more disclosures from this program.

Timeline

Credit to the JTL team for a quick and professional response, and for shipping fixes across every supported branch.

Read more

• Critical backdoor found in MGT Varnish extension
• Adobe patches critical Magento admin takeover via menu injection
• CosmicSting attack & defense overview
• Persistent backdoors injected on Adobe Commerce via new CosmicSting attack
• CosmicSting attack threatens 75% of Adobe Commerce stores