Summary
Sylius can issue JWTs for separate Shop and Admin API contexts without recording which firewall created the token. If a shop customer registers with an administrator's email address, the resulting token may be accepted as that administrator by the Admin API, potentially granting full administrative access.
Affected context
This vulnerability occurs in Sylius deployments that expose separate Shop
and Admin API endpoints protected by JWT authentication. It becomes risky
when identity information, such as an email address, is trusted without
binding the token to the firewall or security context that issued it.
The issue primarily affects flows where a customer can register or control
an account using an email address associated with an administrator.
Exploit preconditions
- Attack surface: Sylius Shop and Admin API authentication flows
- Required access: Ability to register or control a shop customer account
- Trigger point: Authentication to the Admin API using a JWT issued by the
Shop API
- Why exploitation is possible: The JWT does not identify its issuing
firewall, allowing the Admin API to resolve a matching administrator
identity from a customer-controlled account
Why this happens
The underlying flaw is an authentication-context confusion caused by JWTs
that lack reliable firewall identification. Separate security domains issue
tokens with overlapping identity attributes, such as email addresses, but
the receiving API does not sufficiently verify the token's origin or
intended audience.
This maps to CWE-287: Improper Authentication because the application
accepts an identity assertion without validating all security-context
properties needed to establish that the requester is the claimed
administrator.
Potential impact
- An attacker could obtain unauthorized administrative access
- Administrative data could be viewed, changed, or deleted
- Store configuration and operational workflows may be modified
- Customer, order, or payment-related information could be exposed
- Additional compromise could occur if administrative functions affect
server-side integrations or privileged resources
General mitigation guidance
Mitigation generally focuses on preserving strict separation between Shop
and Admin authentication contexts.
Common defensive patterns include:
- Binding tokens to an explicit issuer, audience, firewall, or security
domain
- Rejecting tokens issued for one API context when presented to another
- Validating administrative identity and privileges independently of
customer-controlled registration data
- Using distinct signing keys, claims, and validation policies for
separate APIs where appropriate
- Applying least privilege to administrative roles and sensitive endpoints
- Avoiding email address alone as a trusted indicator of administrative
identity
- Requiring stronger authentication controls for administrative access
How teams detect issues like this
Detection approaches can include:
- Static analysis and code review for JWT validation that omits issuer,
audience, firewall, or security-context checks
- Tests confirming that Shop-issued tokens cannot authenticate to Admin
endpoints
- Review of account-registration logic for collisions with privileged
identities
- Authentication logs correlating token origin, endpoint, resolved user,
and assigned roles
- Policy enforcement requiring separate validation rules for distinct API
security domains
- Automated security testing that exercises cross-context token reuse
