Nyankiyoshi

**Name of the Vulnerable Software and Affected Versions** Saleor versions 3.2.0 through 3.20.109 Saleor versions 3.21.0-a.0 through 3.21.44 Saleor versions 3.22.0-a.0 through 3.22.28 **Description** Saleor, an e-commerce platform, is affected by an Insecure Direct Object Reference (IDOR) issue. This allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 may have Personally Identifiable Information (PII) exfiltrated. The issue allows unauthorized access to data through direct object references. **Recommendations** Update to Saleor version 3.22.29. Update to Saleor version 3.21.45. Update to Saleor version 3.20.110. Temporarily block non-staff users from fetching order information using the `order()` GraphQL query with a Web Application Firewall (WAF).

Name of the Vulnerable Software and Affected Versions: Saleor versions 3.21.0 through 3.21.15 Description: Saleor is an e-commerce platform. Requesting certain fields in the response of the `accountRegister` API endpoint may reveal whether a user with a provided email address already exists in the system. This could potentially expose user account information. As a workaround, rate-limiting the mutation is recommended to reduce the impact. Recommendations: Update to version 3.21.16 or later. Rate-limit the `accountRegister` mutation.

**Name of the Vulnerable Software and Affected Versions** Saleor versions 3.10.0 through 3.14.63 Saleor versions 3.15.0 through 3.15.38 Saleor versions 3.16.0 through 3.16.38 Saleor versions 3.17.0 through 3.17.34 Saleor versions 3.18.0 through 3.18.30 Saleor versions 3.19.0 through 3.19.18 **Description** Saleor is an e-commerce platform. An attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with an empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT REFRESH TOKEN COOKIE NAME` cookie, the application omits validation against CSRF token and returns a valid access token. **Recommendations** For versions 3.10.0 through 3.14.63, update to version 3.14.64 or later. For versions 3.15.0 through 3.15.38, update to version 3.15.39 or later. For versions 3.16.0 through 3.16.38, update to version 3.16.39 or later. For versions 3.17.0 through 3.17.34, update to version 3.17.35 or later. For versions 3.18.0 through 3.18.30, update to version 3.18.31 or later. For versions 3.19.0 through 3.19.18, update to version 3.19.19 or later. As a temporary workaround, consider replacing `saleor.graphql.account.mutations.authentication.refresh token.py.get refresh token` to fix the issue, but be aware that it returns `JWT MISSING TOKEN` instead of `JWT INVALID TOKEN`.

**Name of the Vulnerable Software and Affected Versions** Saleor versions prior to 3.14.61 Saleor versions prior to 3.15.37 Saleor versions prior to 3.16.34 Saleor versions prior to 3.17.32 Saleor versions prior to 3.18.28 Saleor versions prior to 3.19.15 **Description** The issue occurs when using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions, allowing the customer to overwrite the warehouse address with its own, which exposes its address as click-and-collect address. **Recommendations** For versions prior to 3.14.61, upgrade to version 3.14.61 or later. For versions prior to 3.15.37, upgrade to version 3.15.37 or later. For versions prior to 3.16.34, upgrade to version 3.16.34 or later. For versions prior to 3.17.32, upgrade to version 3.17.32 or later. For versions prior to 3.18.28, upgrade to version 3.18.28 or later. For versions prior to 3.19.15, upgrade to version 3.19.15 or later. As a temporary workaround, consider turning off click-and-collect delivery method on warehouse view when `Pickup` option is set to `Local stock only`.

**Name of the Vulnerable Software and Affected Versions** Saleor Core versions prior to 3.7.68 Saleor Core versions prior to 3.8.40 Saleor Core versions prior to 3.9.49 Saleor Core versions prior to 3.10.36 Saleor Core versions prior to 3.11.35 Saleor Core versions prior to 3.12.25 Saleor Core versions prior to 3.13.16 **Description** The `validate hmac signature` function in Saleor Core is susceptible to timing attacks, which malicious users could exploit in deployments with the Adyen plugin enabled. This could allow them to determine the secret key and forge fake events, potentially affecting database integrity, such as incorrectly marking orders as paid. **Recommendations** For versions prior to 3.7.68, update to version 3.7.68 or later. For versions prior to 3.8.40, update to version 3.8.40 or later. For versions prior to 3.9.49, update to version 3.9.49 or later. For versions prior to 3.10.36, update to version 3.10.36 or later. For versions prior to 3.11.35, update to version 3.11.35 or later. For versions prior to 3.12.25, update to version 3.12.25 or later. For versions prior to 3.13.16, update to version 3.13.16 or later.

**Name of the Vulnerable Software and Affected Versions** Saleor versions prior to 3.1.48 Saleor versions prior to 3.7.59 Saleor versions prior to 3.8.0 Saleor versions prior to 3.9.27 Saleor versions prior to 3.10.14 Saleor versions prior to 3.11.12 **Description** Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. **Recommendations** For versions prior to 3.1.48, update to version 3.1.48 or later. For versions prior to 3.7.59, update to version 3.7.59 or later. For versions prior to 3.8.0, update to version 3.8.0 or later. For versions prior to 3.9.27, update to version 3.9.27 or later. For versions prior to 3.10.14, update to version 3.10.14 or later. For versions prior to 3.11.12, update to version 3.11.12 or later.

**Name of the Vulnerable Software and Affected Versions** Saleor versions prior to 3.1.48 Saleor versions prior to 3.7.59 Saleor versions prior to 3.8.30 Saleor versions prior to 3.9.27 Saleor versions prior to 3.10.14 Saleor versions prior to 3.11.12 **Description** The issue arises from internal Python exceptions not being handled properly, resulting in error messages being returned via the API. These messages may contain sensitive information, such as user email addresses, particularly in staff-authenticated requests. **Recommendations** For versions prior to 3.1.48, update to version 3.1.48 or later. For versions prior to 3.7.59, update to version 3.7.59 or later. For versions prior to 3.8.30, update to version 3.8.30 or later. For versions prior to 3.9.27, update to version 3.9.27 or later. For versions prior to 3.10.14, update to version 3.10.14 or later. For versions prior to 3.11.12, update to version 3.11.12 or later.

**Name of the Vulnerable Software and Affected Versions** Saleor versions prior to 3.1.24 Saleor versions prior to 3.2.14 Saleor versions prior to 3.3.26 Saleor versions prior to 3.4.24 Saleor versions prior to 3.5.23 Saleor versions prior to 3.6.18 Saleor versions prior to 3.7.17 **Description** The issue affects a headless, GraphQL commerce platform, where some GraphQL mutations did not properly check the ID type input. This allowed access to database objects that the authenticated user may not be allowed to access, potentially exposing information such as database row counts from tables with a sequential primary key or staff user and customer email addresses and full names through the `assignNavigation()` mutation. **Recommendations** For versions prior to 3.1.24, upgrade to version 3.1.24 or later. For versions prior to 3.2.14, upgrade to version 3.2.14 or later. For versions prior to 3.3.26, upgrade to version 3.3.26 or later. For versions prior to 3.4.24, upgrade to version 3.4.24 or later. For versions prior to 3.5.23, upgrade to version 3.5.23 or later. For versions prior to 3.6.18, upgrade to version 3.6.18 or later. For versions prior to 3.7.17, upgrade to version 3.7.17 or later.