Sylius affected by IDOR in Cart and Checkout LiveComponents

Vulnerability

Overview

An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple Sylius shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled. Any action that accepts a resource ID via #[LiveArg] and loads it with ->find() without ownership validation is vulnerable. The affected components are the Checkout address FormComponent (addressFieldUpdated action), Cart WidgetComponent (refreshCart action), and Cart SummaryComponent (refreshCart action) [1][2].

Exploitation

An authenticated attacker can manipulate the addressId or cartId parameters to load arbitrary addresses or orders from the repository. Since the sylius_order table contains both active carts (state=cart) and completed orders (state=new/fulfilled) in the same ID space, the cart IDOR exposes data from all orders, not just active carts [1].

Impact

Successful exploitation exposes another user's personal data (first name, last name, company, phone number, street, city, postcode, country) from the address component, and order financial details (order total, item count, subtotal, discount, shipping cost, taxes, and order total) from the cart components [1][2].

Mitigation

The issue is fixed in Sylius versions 2.0.16, 2.1.12, and 2.2.3 and above. As a workaround, administrators can override the vulnerable LiveComponent classes at the project level to add authorization checks to #[LiveArg] parameters [1].