Authorization Bypass in CoreShop Allows Order Manipulation

Executive Summary

CoreShop through version 1.5.5 has an authorization bypass flaw in the OrderController. Authenticated customers can manipulate other users' orders by supplying user-controlled IDs. Attackers can omit the data field in OrderConfirm or provide a different reshipId in SendReship to confirm receipt of others' orders and overwrite return tracking details.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for suspicious OrderConfirm or SendReship requests where the data field is omitted or reshipId is manipulated. Check for requests with mismatched user IDs and order IDs. Use tools like Burp Suite or Postman to send test requests to /api/Order/OrderConfirm and /api/Order/SendReship with varying parameters to observe unauthorized access attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could confirm receipt of your orders without payment, disrupting fulfillment. They could also alter return shipment tracking details, potentially causing refund issues or logistical confusion. This requires only a valid authenticated session and knowledge of your order IDs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and modification of order data, which may violate data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized confirmation of orders or altering return tracking details could expose sensitive customer information or disrupt compliance with audit trails and transaction records.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update CoreShop to a patched version beyond 1.5.5. If an update is unavailable, implement strict input validation for orderId and reshipId parameters in OrderConfirm and SendReship endpoints. Enforce ownership checks by binding operations to the authenticated user's ID (_user.ID) and validate that the user owns the order before processing requests.

Useful 0 Not Useful 0