OroCommerce get-totals-for-checkout API endpoint returns unwanted data

Vulnerability

OroCommerce, an open-source B2B e-commerce application, contains an information disclosure vulnerability where detailed order totals can be retrieved by simply providing an order ID. The issue stems from insufficient access controls on the order totals endpoint, allowing any authenticated or possibly unauthenticated user to query order data without proper ownership verification [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a request to the affected endpoint with a known or guessed order ID. The attack is remotely exploitable, requires low complexity, and no special privileges or user interaction. The attacker only needs network access to the OroCommerce instance [2].

Impact

Successful exploitation allows an attacker to view detailed order totals for any order, potentially exposing sensitive business transaction data. This could lead to competitive intelligence gathering or privacy violations, depending on the nature of the orders [1][2].

Mitigation

The vulnerability has been patched in OroCommerce versions 5.0.11 and 5.1.1. Users are strongly advised to upgrade to these versions or later. No workarounds have been officially provided [1][2].