Executive brief
Saleor, a headless GraphQL e-commerce platform, is affected by a vulnerability where internal system errors are not properly handled. This can cause the platform to reveal sensitive technical details about its underlying infrastructure to any user on the internet, even without logging in. While this does not directly allow an attacker to modify data, the leaked information could be used to plan more sophisticated attacks against the company's servers.
Technical details
Saleor (versions 2.0.0 and later) fails to properly sanitize internal Python exceptions before returning them as GraphQL API error messages. This vulnerability, classified as CWE-209, allows an unauthenticated remote attacker to trigger specific application states that result in unhandled exceptions. The resulting error responses may disclose sensitive environment or infrastructure details. The attack complexity is rated as high because it typically requires specific conditions to trigger the informative exceptions. Patches have been released across multiple major versions including 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14, and 3.11.12.
Affected products
- Saleor Saleor >= 2.0.0, < 3.1.48; >= 3.7.0, < 3.7.59; >= 3.8.0, < 3.8.30; >= 3.9.0, < 3.9.27; >= 3.10.0, < 3.10.14; >= 3.11.0, < 3.11.12
Timeline
- 2023-03-02: advisory
- 2023-03-02: patched