Executive brief
EverShop is an open-source Node.js e-commerce platform. A lack of authentication controls in its GraphQL API endpoints allows unauthenticated remote attackers to access sensitive information. An attacker can query the GraphQL endpoints directly without credentials to retrieve data that should require authorization.
Technical details
This vulnerability is an improper authorization and authentication bypass affecting EverShop's GraphQL endpoints (CWE-285, CWE-287). The issue stems from insufficient authentication checks in the GraphQL API layer, allowing remote attackers to send requests to sensitive GraphQL queries without providing valid credentials. The attack vector is network-based with no prerequisites (no authentication required, no user interaction). An attacker can gain unauthorized access to sensitive business data such as customer information, orders, and product details. The vulnerability was fixed in version 1.0.0-rc.9; users must upgrade to this version or later.
Affected products
- EverShop EverShop before 1.0.0-rc.9
Timeline
- 2024-01-13: disclosed
- 2023-10-01: patched: Fix committed; version 1.0.0-rc.9 released