CVE-2020-15085: Client caching login operation with plaintext password in Saleor Storefront
In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0 persisted the cache even after the user logged out. This is fixed in version 2.10.3. A workaround is to manually clear application data (browser's local storage) after logging into Saleor Storefront.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Saleor Storefront installations before version 2.10.3 are affected. The issue is most relevant on browsers that may be accessed by another person, because the cached local-storage data can include the customer's email address and password.
What access does an attacker need to obtain credentials?
An attacker needs direct access to a browser that has been used to log in to the affected Storefront. No remote-only attack path is described; the attacker can extract credentials from the browser's local storage.
Does logging out remove the exposed data?
In versions earlier than 2.10.0, the persisted cache remained even after the customer logged out. Therefore, logging out alone does not ensure that the stored credential data has been removed on those versions.
What can be done if an immediate upgrade is not possible?
Upgrade Saleor Storefront to version 2.10.3. If patching cannot happen immediately, manually clear the browser's application data, including local storage, after logging in.