[Security] Missing authorization in customer API + SSRF — EverShop <= v2.1.2

[Security] Missing Authorization in Customer API + SSRF in Image Processor (v2.1.2)

Note: Full exploit details withheld from public report. Contact: [email protected]

Affected Version

EverShop <= v2.1.2

Vulnerabilities Found

1. Unauthenticated Account Takeover — PATCH /api/customers/:id (Critical · CWE-862 · CVSS 9.1) Route is access:"public", auth middleware skips. Handler has no ownership check. Any caller with a customer UUID can overwrite their email and password. File: modules/customer/api/updateCustomer/updateCustomer.js

2. IDOR — Customer Address Endpoints (High · CWE-639 · CVSS 7.5) POST/PATCH/DELETE /customers/:customer_id/addresses — same access:"public" + no ownership check. Any caller can create, modify, or delete any customer's addresses without authentication. Files: createCustomerAddress.js, updateCustomerAddress.js, deleteCustomerAddress.js

3. SSRF — GET /images?src= (High · CWE-918 · CVSS 8.6) Image processor fetches any external URL without IP validation. Enables requests to internal services and cloud metadata (AWS IMDSv1 169.254.169.254). File: modules/cms/services/imageProcessor.ts

Fix Available

https://github.com/iaohkut/evershop-old/tree/fix/missing-auth-customer-api

Disclosure Timeline

• 2026-06-03: Confirmed dynamically on v2.1.2
• 2026-09-01: 90-day public disclosure deadline

Please acknowledge at [email protected] for full technical details.