CVE-2024-40633

The vulnerability resides in the /api/v2/shop/adjustments/{id} endpoint of Sylius, an open-source eCommerce framework built on Symfony [1]. The endpoint uses incremental integer IDs to retrieve order adjustments. An attacker can exploit this predictable ID pattern to enumerate valid adjustment IDs and extract associated order tokens [3].

No special privileges are required; the endpoint is publicly accessible in the shop API [2]. By sending sequential requests to /api/v2/shop/adjustments/{id}, an attacker can discover valid adjustment IDs and retrieve the corresponding order tokens [1]. These tokens are then used to access guest customer order details without authentication [3].

The impact is information disclosure: an attacker can obtain sensitive guest customer information, including order details, by leveraging the enumerated tokens [1]. This compromises the confidentiality of guest customer data in the eCommerce platform [3].

The issue is patched in Sylius versions 1.12.19 and 1.13.4, where the endpoint is disabled and always returns a 404 status [2][3]. Users unable to upgrade can apply a configuration workaround by overriding the endpoint to use ApiPlatform\Core\Action\NotFoundAction, as detailed in the advisory [3].