GHSA-xf65-r35x-wmmv: Infoleak
The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false). This injected guard was combined with the caller-supplied filter using the caller-controlled filterOperator. When a caller sets filterOperator: OR, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.
Impact Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.
Patches The injected guard is now always AND-combined with the caller-supplied filter, regardless of filterOperator.
Workarounds None other than upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@vendure/coreto a version that resolves this vulnerability.Fixed in 3.6.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated caller that can access the publicly available Shop API can exploit it. No privileges or user interaction are required.
What request behavior triggers exposure of hidden catalog entities?
The caller must supply filterOperator: OR and a filter predicate that matches disabled products or private collections or facets. This causes the public-visibility guard to be OR-combined with the caller-controlled filter.
What information can be exposed?
Disabled products and private collections or facets can be returned through the Shop API queries. The issue is an information disclosure; the provided data does not indicate integrity or availability impact.
Is there a workaround if upgrading cannot happen immediately?
No workaround is provided other than upgrading. The patch ensures the mandatory visibility guard is always combined with caller-supplied filters using AND.