Shopper Missing Authorization Lets Admin-Panel Users Escalate Privileges

Executive Summary

This vulnerability is a missing authorization flaw in Shopper versions 2.0.0 before 2.6.0. It allows users with only access_dashboard permission to create administrator accounts and grant elevated permissions by exploiting unprotected Livewire components. Attackers can call specific methods like CreateTeamMember::store() or Permissions::togglePermission() via the /livewire/update endpoint to escalate privileges to full administrator access.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized admin account creation by monitoring /livewire/update endpoint calls. Review server logs for POST requests to CreateTeamMember::store() or Permissions::togglePermission(). Inspect Livewire components in admin panel for missing $this->authorize() checks.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with minimal dashboard access to create new admin accounts, modify roles and permissions, and change store settings. This could lead to full control of the Shopper application, unauthorized access to sensitive data, and potential compromise of the entire system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized privilege escalation, enabling attackers with minimal access to create admin accounts and grant elevated permissions. This could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's access control requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Shopper version 2.6.0 or later. Ensure all admin Livewire components include $this->authorize() checks. Remove access_dashboard permissions from non-admin users. Monitor for unauthorized admin account creation.

Useful 0 Not Useful 0