CVE-2019-1010304: Medium severity saleor vulnerability
Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under /graphql/ URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Saleor installations running a release affected by this issue are exposed if their GraphQL endpoint is publicly reachable. The endpoint is publicly exposed at /graphql/ by default.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker only needs network access to the publicly exposed GraphQL API to query product data.
What information could be exposed?
The affected ProductVariant GraphQL API can return product data that may include shop revenue information normally restricted to administrators. The stated impact is information disclosure; integrity and availability are not affected.
What should be done if the deployment cannot be patched immediately?
Upgrade to Saleor 2.3.1, which is identified as the fixed version. If patching cannot happen immediately, restricting unauthenticated access to the /graphql/ endpoint addresses the described attack path.