Executive brief
Vue Storefront is an e-commerce API platform used to build progressive web app storefronts. When the API receives malformed or unexpected HTTP requests, it exposes detailed error stack traces that reveal internal file paths and Node.js module information. An attacker can exploit this to map out the application's internal structure, potentially facilitating further attacks.
Technical details
The vulnerability is an information disclosure (CWE-200, CWE-209) in Divante vue-storefront-api and storefront-api where unhandled HTTP requests trigger exceptions that return full stack traces to the client. The vulnerable component lacks proper error handling and filtering, exposing absolute file paths and Node.js module names in HTTP responses. The attack vector is network-based with no authentication required—any attacker can send crafted requests to trigger the disclosure. While the information exposure is limited to path enumeration and does not directly compromise user data or system availability, it aids reconnaissance for subsequent attacks. Fixes are available: vue-storefront-api 1.12.0+ and storefront-api 1.0.0-rc3+.
Affected products
- Divante vue-storefront-api through 1.11.1
- Divante storefront-api through 1.0-rc.1
Timeline
- 2020-04-17: disclosed
- 2022-05-24: advisory