Executive brief
Saleor is an e-commerce platform used to manage online stores and shopping experiences. A security flaw in how the system handles errors allows staff members to see sensitive internal information, such as user email addresses, that should normally be hidden. This could lead to the exposure of customer data to unauthorized staff or anyone who gains access to a staff account.
Technical details
The vulnerability is a sensitive information disclosure (CWE-209) within the Saleor GraphQL API. It occurs because certain internal Python exceptions are not properly caught or sanitized before being returned to the client. An attacker with staff-level authentication can trigger these exceptions through specific API requests to view sensitive data, such as user email addresses, contained within the error messages. The fix involves implementing a blocklist/allowlist for exception messages to ensure internal system details are not leaked. Patches are available in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14, and 3.11.12.
Affected products
- Saleor Saleor >= 2.0.0, < 3.1.48; >= 3.7.0, < 3.7.59; >= 3.8.0, < 3.8.30; >= 3.9.0, < 3.9.27; >= 3.10.0, < 3.10.14; >= 3.11.0, < 3.11.12
Timeline
- 2023-03-02: patched: Fix committed to repository
- 2023-03-02: disclosed: NVD publication date
- 2023-03-03: advisory: GitHub Advisory published
References
- https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85
- https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1
- https://github.com/saleor/saleor/releases/tag/3.1.48
- https://github.com/saleor/saleor/releases/tag/3.10.14
- https://github.com/saleor/saleor/releases/tag/3.11.12