CVE-2024-39325

Executive Summary

CVE-2024-39325 is a missing authorization vulnerability in the Aimeos frontend controller (ai-controller-frontend). The flaw allows an attacker to bypass payment status validation after a purchase is completed. Specifically, the application fails to reset the payment status of a user's basket after a successful purchase. This means that a user could potentially reuse a previously paid basket state to trigger unauthorized actions, such as re-downloading digital goods, re-applying discounts, or manipulating order workflows without making a new payment. The vulnerability has a CVSS score of 5.3 (Medium) and affects all versions prior to the patched releases. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of active exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability affects the aimeos/ai-controller-frontend package, which is a PHP component of the Aimeos e-commerce framework. It is distributed via Composer (Packagist). Organizations using Aimeos should verify their composer.json or composer.lock for the affected package and update to the patched versions. The package is not directly available via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the flaw.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – An attacker can modify the payment status or order state.
• Availability (A): None (N) – No denial-of-service impact.

Threat Level: Medium. While the CVSS score is moderate, the lack of required privileges and network-based attack vector makes it a viable target for automated scanning. The primary risk is business logic abuse, such as obtaining digital goods without payment or manipulating order records.

Deep Dive & Mechanics

The vulnerability resides in the basket/payment status handling logic of the Aimeos frontend controller. After a user completes a purchase, the system should reset the basket's payment status to prevent reuse. However, due to a missing authorization check, the payment status is not cleared. This allows an attacker to:

1. Complete a legitimate purchase (e.g., pay for a digital download).
2. Capture the session or basket state that indicates "paid."
3. Replay or reuse that state to trigger another fulfillment action (e.g., download the product again) without paying again.

The root cause is a missing unset or reset of the payment status flag in the controller's post-purchase workflow. The fix involves ensuring that after a successful order, the basket's payment status is explicitly cleared or invalidated.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the controller's checkout action
public function processPayment($basket) {
    // ... payment processing ...
    $basket->setPaymentStatus('paid');
    $order = $this->createOrder($basket);
    // Missing: $basket->resetPaymentStatus();
    return $order;
}

Patched Code (Conceptual):

public function processPayment($basket) {
    // ... payment processing ...
    $basket->setPaymentStatus('paid');
    $order = $this->createOrder($basket);
    $basket->resetPaymentStatus(); // Added to clear the status
    return $order;
}

The patched versions explicitly reset the payment status after the order is created, preventing reuse.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Aimeos instance with a vulnerable version (e.g., 2024.04.1).
• A valid user account (or ability to create one).
• A digital product (e.g., downloadable file) configured in the shop.

Exploitation Steps:

1. Purchase a product: Log in and complete a purchase for a digital good. Note the order ID and session token.
2. Capture the basket state: After payment, intercept the HTTP response or session data that contains the "paid" status.
3. Replay the request: Send a request to the download endpoint (e.g., /download?order_id=XXX) using the same session or basket ID.
4. Verify: The server should allow the download again without requiring a new payment, confirming the vulnerability.

Note: No public exploit code is available. The above steps are based on the vulnerability description.

Blue Team

Detection:

• Monitor for multiple download requests for the same order ID from the same user within a short time frame.
• Alert on any order fulfillment actions that occur without a corresponding payment event.
• Review logs for unusual patterns in the ai-controller-frontend payment processing.

Hunting:

• Search for logs containing paymentStatus or basket with unexpected values.
• Correlate order creation timestamps with download/fulfillment timestamps.

Indicators of Compromise (IOCs)

• Network: Repeated HTTP requests to /download or similar fulfillment endpoints with the same order ID.
• Application Logs: Log entries showing paymentStatus set to paid for a basket that is reused.
• Session: Session tokens or basket IDs that are reused after a purchase is completed.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_39325_Aimeos_Payment_Status {
    meta:
        description = "Detects vulnerable Aimeos code that fails to reset payment status"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-39325"
    strings:
        $vuln_func = "setPaymentStatus" nocase
        $missing_reset = "resetPaymentStatus" nocase
    condition:
        $vuln_func and not $missing_reset
}

Sigma Rule

title: CVE-2024-39325 - Aimeos Payment Status Reuse
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2024-39325 by monitoring for repeated order fulfillment requests.
author: Valters IT
logsource:
    category: application
    product: aimeos
detection:
    selection:
        event: "order_fulfillment"
        order_id|repeated: true
    condition: selection
falsepositives:
    - Legitimate re-downloads by users (e.g., lost files)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39325 - Aimeos Payment Status Reuse Attempt"; flow:to_server; content:"/download"; http_uri; nocase; pcre:"/order_id=[0-9]+/"; threshold:type both, track by_src, count 2, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Aimeos: Update aimeos/ai-controller-frontend to the patched versions:
   • 2024.04.2
   • 2023.10.9
   • 2022.10.8
   • 2021.10.8
   • 2020.10.15
2. Verify patch: After upgrading, test that the payment status is reset after a purchase.

Compensating Controls (if patching is delayed):

• Implement a Web Application Firewall (WAF) rule to block repeated download requests for the same order ID.
• Add server-side validation to check if an order has already been fulfilled before processing a new request.
• Monitor application logs for suspicious patterns.

Long-term:

• Conduct a code review of all payment and order fulfillment logic.
• Implement unit tests to ensure payment status is properly reset.
• Follow secure coding practices for session and state management.

Valters IT