important · Sylius
A Sylius customer account can become an administrator by sharing an administrator’s email address.
Affects
Sylius, a PHP e-commerce framework used by self-hosted online shops.
On a shop with self-registration enabled, an attacker who knows an administrator email can register that address, obtain a Shop API JWT, and present it to the Admin API. Because tokens were not bound to their firewall or principal type, the Admin API resolves the email to the administrator.
Detail and 4 sources
The upstream fix adds audience and principal claims to bind tokens to their intended security boundary.
Sources
Code / PoC[2.2] Add JwtAudienceListener to enforce JWT audience and principal validation by TheMilek · Pull Request #19213 · Sylius/Sylius · GitHubCode / PoCRelease v2.2.9 · Sylius/Sylius · GitHubPatch[2.2] Add JwtAudienceListener to enforce JWT audience and principal v… · Sylius/Sylius@cdfb672 · GitHubSecondarySylius JWT audience confusion can turn a shop account into an administrator