Is CVE-2023-46498 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-46498 being exploited in the wild.

How severe is CVE-2023-46498?

Low severity, with a CVSS score of 3.1, published 8 December 2023.

Which products and versions are affected?

EverShop < 1.0.0-rc.8; @evershop/evershop (npm) SEMVER:introduced=0,fixed=1.0.0-rc.8.

Is there a fix for CVE-2023-46498?

Yes. @evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-46498 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-46498?

Check whether you run EverShop or @evershop/evershop (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-46498: EverShop authorization bypass in deleteCustomer endpoint

Q: Which products and versions are affected?

EverShop < 1.0.0-rc.8; @evershop/evershop (npm) SEMVER:introduced=0,fixed=1.0.0-rc.8.

Q: Is there a fix for CVE-2023-46498?

Yes. @evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-46498 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2023-46498?

Check whether you run EverShop or @evershop/evershop (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-46498 · Severity: low · CVSS 3.1 · Published 2023-12-08

EverShop is a TypeScript-based e-commerce platform. A vulnerability in versions before 1.0.0-rc.8 allows unauthenticated attackers to delete customer accounts and access sensitive information through an unprotected GraphQL endpoint. This could result in widespread account deletion, customer data exposure, and service disruption for merchants using the platform.

Technologies: EverShop, @evershop/evershop (npm). Vendors: EverShop, npm.

Quick answers

Is CVE-2023-46498 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-46498 being exploited in the wild.
How severe is CVE-2023-46498?: Low severity, with a CVSS score of 3.1, published 8 December 2023.
Which products and versions are affected?: EverShop < 1.0.0-rc.8; @evershop/evershop (npm) SEMVER:introduced=0,fixed=1.0.0-rc.8.
Is there a fix for CVE-2023-46498?: Yes. @evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-46498 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-46498?: Check whether you run EverShop or @evershop/evershop (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later
```
npm install @evershop/evershop@1.0.0-rc.8
```

Technical details

The vulnerability is a broken function-level authorization (CWE-285) issue in the route.json configuration of EverShop's GraphQL endpoint. The /deleteCustomer endpoint lacks proper authentication checks, allowing any network-accessible attacker to send DELETE requests without credentials. An attacker can chain this with GraphQL schema introspection to enumerate customer UUIDs, then execute unauthorized deletions of customer accounts. The vulnerability also permits access to sensitive customer information. The issue was fixed in version 1.0.0-rc.8 by implementing authentication requirements (admin credentials) for the endpoint. The patch is available in GitHub pull request #342.

Affected products

EverShop @evershop/evershop < 1.0.0-rc.8

Identifiers

CVE-2023-46498
GHSA-5mmr-9qx3-3pf9

Timeline

2023-12-08: disclosed: Vulnerability published in GitHub Security Advisory GHSA-5mmr-9qx3-3pf9
2023-10-01: patched: Fix merged in PR #342 to v1.0.0-rc.8
2023-09-25: other: Vulnerability initially reported/discovered

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.