CVE-2022-24743: Insufficient Session Expiration in Sylius

Background

Sylius is an open-source e-commerce platform built on top of Symfony. It provides a flexible and customizable solution for creating online stores. The Sylius package is vulnerable to an insufficient session expiration issue, which can lead to unauthorized password changes and token leaks.

Vulnerability Detail

The vulnerability arises from the failure to nullify the reset password token after a password change. This allows the same token to be used multiple times, potentially resulting in unauthorized password changes and the exposure of existing tokens. An attacker could exploit this vulnerability to gain unauthorized access to user accounts and perform malicious actions.

Workaround

If you are unable to immediately update to the fixed versions, you can implement a workaround by overwriting the ResetPasswordHandler class. Below is an example of the code to be used:

<?php

namespace App\CommandHandler\Account;

use Sylius\Bundle\ApiBundle\Command\Account\ResetPassword;
use Sylius\Component\Core\Model\ShopUserInterface;
use Sylius\Component\Resource\Metadata\MetadataInterface;
use Sylius\Component\User\Repository\UserRepositoryInterface;
use Sylius\Component\User\Security\PasswordUpdaterInterface;
use Symfony\Component\Messenger\Handler\MessageHandlerInterface;
use Webmozart\Assert\Assert;

final class ResetPasswordHandler implements MessageHandlerInterface
{
    private UserRepositoryInterface $userRepository;
    private MetadataInterface $metadata;
    private PasswordUpdaterInterface $passwordUpdater;

    public function __construct(
        UserRepositoryInterface $userRepository,
        MetadataInterface $metadata,
        PasswordUpdaterInterface $passwordUpdater
    ) {
        $this->userRepository = $userRepository;
        $this->metadata = $metadata;
        $this->passwordUpdater = $passwordUpdater;
    }

    public function __invoke(ResetPassword $command): void
    {
        // Code to handle password reset
        // ...
        $user->setPasswordResetToken(null);
    }
}

You should register this class in the container as shown in the following YAML configuration:

App\CommandHandler\Account\ResetPasswordHandler:
    arguments:
        - '@sylius.repository.shop_user'
        - !service
              class: Sylius\Component\Resource\Metadata\MetadataInterface
              factory: [ '@sylius.resource_registry', 'get' ]
              arguments:
                    - 'sylius.shop_user'
                    - '@sylius.security.password_updater'
    tags:
        - { name: messenger.message_handler, bus: sylius.command_bus }
        - { name: messenger.message_handler, bus: sylius_default.bus }

This workaround ensures that the reset password token is set to null after a password change, mitigating the vulnerability.

Conclusion

The Sylius package is vulnerable to an insufficient session expiration issue that can lead to unauthorized password changes and token leaks. It is crucial to update the package to the recommended versions or apply the provided workaround to mitigate the vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for sylius/sylius →

FAQ