Executive brief
express-cart is a Node.js-based e-commerce shopping cart application. The vulnerability allows any authenticated user to create an administrative account by manipulating an HTTP Referer header sent to the /admin/setup endpoint, bypassing normal access controls. An attacker with user-level access can escalate privileges to admin, gaining complete control over the application and potentially accessing sensitive customer data and business operations.
Technical details
The vulnerability is an authentication bypass (CWE-732: Incorrect Permission Assignment) in the /admin/setup endpoint. The root cause is improper validation of the Referer header when processing admin user creation requests. An authenticated attacker can send a crafted request to /admin/setup with a malicious Referer header to bypass the intended access controls and create an admin account. This requires the attacker to already have valid user credentials (low privilege) but does not require administrator rights. The vulnerability affects express-cart versions prior to 1.1.6 and was patched in commit baccaae9b0b72f00b10c5453ca00231340ad3e3b.
Affected products
- mrvautin express-cart before 1.1.6
Timeline
- 2018-06-15: disclosed
- 2018: patched: Fixed in version 1.1.6