NetSight
IP …
medium4.2

CVE-2024-31205

Saleor is an e-commerce platform.

Impact

Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.

Affected products

VendorProductAffected versions
SaleorSaleor
from 3.10.0 before 3.14.64
from 3.15.0 before 3.15.39
from 3.16.0 before 3.16.39
from 3.17.0 before 3.17.35
from 3.18.0 before 3.18.31
from 3.19.0 before 3.19.19

Weakness classification

CWE-352

References