Authentication Bypass in Sylius via JWT Token Misconfiguration

Executive Summary

This vulnerability is a JWT audience confusion flaw in Sylius, an e-commerce framework. It allows an attacker to register a shop customer account using an administrator's email address, obtain a JWT token, and then use that token to gain full administrative access to the Admin API. The issue occurs because JWT tokens issued by separate Admin and Shop API endpoints lack firewall identification, causing the Admin API to misinterpret the token as belonging to an administrator.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Sylius installation is running a vulnerable version (1.11.0 to 1.12.24, 1.13.0 to 1.13.16, 1.14.0 to 1.14.19, 2.0.0 to 2.1.15, or 2.2.0 to 2.2.8). Verify if JWT tokens lack the 'aud' and 'principal_type' claims. Inspect API responses for improper authentication bypass attempts.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain full administrative access to your Sylius-based e-commerce system. This could lead to unauthorized data access, modification, or deletion, including customer information, orders, and payment details. The impact includes potential data breaches, financial loss, and reputational damage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and loss of customer trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Sylius to a patched version (1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9). If upgrading is not possible, implement the workaround by adding a custom JwtAudienceListener to enforce JWT audience and principal validation as described in the GitHub advisory.

Useful 0 Not Useful 0