CyberRota Analysis
AI-GeneratedThe customer update route in EverShop is vulnerable due to improper access controls, allowing unauthenticated users to overwrite customer account details, including email addresses and passwords, using known customer UUIDs. This critical flaw can lead to account takeovers and unauthorized access, making it imperative for organizations using EverShop to prioritize immediate updates to version 2.2.1 or later. All administrators and security teams managing EverShop installations should address this vulnerability to protect customer accounts from exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".