Executive brief
EverShop is a TypeScript-based e-commerce platform. A vulnerability in versions before 1.0.0-rc.8 allows unauthenticated attackers to delete customer accounts and access sensitive information through an unprotected GraphQL endpoint. This could result in widespread account deletion, customer data exposure, and service disruption for merchants using the platform.
Technical details
The vulnerability is a broken function-level authorization (CWE-285) issue in the route.json configuration of EverShop's GraphQL endpoint. The /deleteCustomer endpoint lacks proper authentication checks, allowing any network-accessible attacker to send DELETE requests without credentials. An attacker can chain this with GraphQL schema introspection to enumerate customer UUIDs, then execute unauthorized deletions of customer accounts. The vulnerability also permits access to sensitive customer information. The issue was fixed in version 1.0.0-rc.8 by implementing authentication requirements (admin credentials) for the endpoint. The patch is available in GitHub pull request #342.
Affected products
- EverShop @evershop/evershop < 1.0.0-rc.8
Timeline
- 2023-12-08: disclosed: Vulnerability published in GitHub Security Advisory GHSA-5mmr-9qx3-3pf9
- 2023-10-01: patched: Fix merged in PR #342 to v1.0.0-rc.8
- 2023-09-25: other: Vulnerability initially reported/discovered