Is CVE-2018-12457 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-12457 being exploited in the wild.

How severe is CVE-2018-12457?

Low severity, with a CVSS score of 3, published 13 May 2022.

Which products and versions are affected?

express-cart (npm) SEMVER:introduced=0,fixed=1.1.6.

Is there a fix for CVE-2018-12457?

Yes. express-cart (npm): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-12457 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-12457?

Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-12457: express-cart admin user creation auth bypass

CVE-2018-12457 · Severity: low · CVSS 3 · Published 2022-05-13

express-cart is a Node.js-based e-commerce shopping cart application. The vulnerability allows any authenticated user to create an administrative account by manipulating an HTTP Referer header sent to the /admin/setup endpoint, bypassing normal access controls. An attacker with user-level access can escalate privileges to admin, gaining complete control over the application and potentially accessing sensitive customer data and business operations.

Technologies: express-cart (npm). Vendors: npm.

Quick answers

Is CVE-2018-12457 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-12457 being exploited in the wild.
How severe is CVE-2018-12457?: Low severity, with a CVSS score of 3, published 13 May 2022.
Which products and versions are affected?: express-cart (npm) SEMVER:introduced=0,fixed=1.1.6.
Is there a fix for CVE-2018-12457?: Yes. express-cart (npm): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-12457 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-12457?: Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

express-cart (npm): upgrade to 1.1.6 or later
```
npm install express-cart@1.1.6
```

Technical details

The vulnerability is an authentication bypass (CWE-732: Incorrect Permission Assignment) in the /admin/setup endpoint. The root cause is improper validation of the Referer header when processing admin user creation requests. An authenticated attacker can send a crafted request to /admin/setup with a malicious Referer header to bypass the intended access controls and create an admin account. This requires the attacker to already have valid user credentials (low privilege) but does not require administrator rights. The vulnerability affects express-cart versions prior to 1.1.6 and was patched in commit baccaae9b0b72f00b10c5453ca00231340ad3e3b.

Affected products

mrvautin express-cart before 1.1.6

Identifiers

CVE-2018-12457
GHSA-hr89-w7p6-pjmq

Timeline

2018-06-15: disclosed
2018: patched: Fixed in version 1.1.6

References

https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.