Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 5
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Sylius Sylius
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
|
1.11.0
|
1.12.25
|
|
Sylius Sylius
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
|
1.13.0
|
1.13.17
|
|
Sylius Sylius
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
|
1.14.0
|
1.14.20
|
|
Sylius Sylius
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
|
2.0.0
|
2.1.16
|
|
Sylius Sylius
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
|
2.2.0
|
2.2.9
|
References 6
https://github.com/Sylius/Sylius
disclosure@vulncheck.com
https://github.com/Sylius/Sylius/commit/cdfb672a4d174eb2c73159b25cf5b5f44088f45c
disclosure@vulncheck.com
https://github.com/Sylius/Sylius/pull/19213
disclosure@vulncheck.com
https://github.com/Sylius/Sylius/releases/tag/v2.2.9
disclosure@vulncheck.com
https://github.com/Sylius/Sylius/security/advisories/GHSA-f6mx-qxjc-55xf
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.…
disclosure@vulncheck.com