Executive brief
Vendure, an e-commerce GraphQL framework, had insecure default cookie settings that left all API requests vulnerable to Cross-Site Request Forgery (CSRF) attacks. Attackers could trick authenticated users into performing unwanted actions on the platform, such as modifying orders or account settings, by exploiting the lack of SameSite protection on session cookies.
Technical details
The vulnerability is a CSRF weakness caused by the SameSite cookie attribute being set to false by default (inherited from the cookie-session npm package), which prevents browser enforcement of same-origin policies for session cookies. The affected component is the authentication cookie configuration in the Vendure core framework. Any API request from an authenticated user can be exploited via CSRF if the user visits a malicious website while authenticated to a Vendure instance. The attack requires no additional authentication or special privileges—the attacker simply sends a forged request that the victim's browser will execute with their existing session cookie. The issue was patched in version 2.0.3 by setting sameSite to 'lax' by default; administrators can also manually configure the option to 'strict' or 'lax' as a workaround.
Affected products
- Vendure core before 2.0.3
Timeline
- 2023-07-11: disclosed
- 2023-07-11: patched: Version 2.0.3 released with fix