Executive Summary

This vulnerability exists in the Sylius Open Source eCommerce Framework on Symfony, specifically in the POST /api/v2/shop/orders/{tokenValue}/items endpoint.

The endpoint does not verify cart ownership, which means an unauthenticated attacker who knows a cart's tokenValue can add items to that cart.

In other words, if an attacker obtains the tokenValue of another customer's cart, they can add arbitrary items to that customer's cart without authentication.

Additionally, the endpoint returns the full cart representation in the response, which could expose further information.

This issue has been fixed in Sylius versions 2.0.16, 2.1.12, 2.2.3 and above.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to manipulate your shopping cart without your consent.

An attacker could add unwanted or arbitrary items to your cart, potentially causing confusion, incorrect orders, or financial implications if the order is processed.

Since the attacker does not need to be authenticated, this could affect any customer whose cart tokenValue is known or guessed.

Furthermore, the exposure of the full cart representation in the response could leak sensitive information about your cart contents.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Sylius to version 2.0.16, 2.1.12, 2.2.3 or above, where the issue has been fixed.

Useful 0 Not Useful 0