Executive brief
Taylored is a Node.js framework for building e-commerce backends that deliver commercial software patches. Version 7.0.7 contained four security flaws that could allow attackers to read arbitrary files from the server, bypass payment verification to obtain patches without paying, reuse purchase tokens indefinitely, and weaken encryption protecting patches. Organizations using Taylored 7.0.7 must immediately upgrade and regenerate their backends.
Technical details
The vulnerabilities in Taylored 7.0.7 span multiple attack surfaces: (1) Path traversal in the patch download endpoint allowing unauthenticated file reads via unsanitized `patchId` parameter, (2) Missing cryptographic validation of PayPal webhook signatures, enabling spoofed purchase notifications, (3) Absence of token invalidation logic permitting replay of legitimate purchase tokens, and (4) Weak PBKDF2 key derivation (100k iterations) making encrypted patches susceptible to brute-force attacks. All are network-accessible without authentication. Version 7.0.8 patches all four issues and requires regeneration of affected backends and recreation of encrypted patches due to cryptography improvements.
Affected products
- Taylored taylored 7.0.5 to 7.0.7
Timeline
- 2025-06-18: disclosed: GHSA-8g98-m4j9-qww5 published
- 2025-06-18: patched: Version 7.0.8 released with fixes