Summary
NivoCart through version 2.5.1 does not adequately authorize access to guest order invoices. An unauthenticated attacker may retrieve invoices for other guest orders by changing the order identifier, exposing personal and purchase information when guest-order records are accessible through the download action.
NivoCart through version 2.5.1 does not adequately authorize access to guest order invoices. An unauthenticated attacker may retrieve invoices for other guest orders by changing the order identifier, exposing personal and purchase information when guest-order records are accessible through the download action.
Affected context
The vulnerability occurs in NivoCart's account/order download functionality when invoice retrieval relies on an order identifier without confirming that the requester is authorized to access the associated order. It primarily affects deployments that permit guest checkout and represent guest orders with a shared customer identifier, such as customer_id 0. The practical exposure depends on order identifier predictability, endpoint accessibility, and whether additional ownership checks are enforced.
The vulnerability occurs in NivoCart's account/order download functionality when invoice retrieval relies on an order identifier without confirming that the requester is authorized to access the associated order. It primarily affects deployments that permit guest checkout and represent guest orders with a shared customer identifier, such as customer_id 0. The practical exposure depends on order identifier predictability, endpoint accessibility, and whether additional ownership checks are enforced.
Exploit preconditions
- Attack surface: The publicly reachable invoice download action under the account/order functionality
- Required access: No authenticated account or established session may be required
- Trigger point: Processing an invoice download request associated with an order identifier
- Why exploitation is possible: The action may retrieve a guest order based on the supplied identifier without verifying that the requester owns or is otherwise authorized to view that order
- Enumeration condition: Predictable or discoverable order identifiers can allow access attempts across multiple guest orders
- Attack surface: The publicly reachable invoice download action under the account/order functionality
- Required access: No authenticated account or established session may be required
- Trigger point: Processing an invoice download request associated with an order identifier
- Why exploitation is possible: The action may retrieve a guest order based on the supplied identifier without verifying that the requester owns or is otherwise authorized to view that order
- Enumeration condition: Predictable or discoverable order identifiers can allow access attempts across multiple guest orders
Why this happens
The underlying defect is a missing authorization check, mapping to CWE-862: Missing Authorization. The download action appears to treat possession of an order identifier as sufficient authority to retrieve an invoice, rather than enforcing an access-control decision tied to the requester and the specific order. Shared guest-customer records can further weaken ownership validation when they are used without an independent, unguessable authorization token or equivalent control.
The underlying defect is a missing authorization check, mapping to CWE-862: Missing Authorization. The download action appears to treat possession of an order identifier as sufficient authority to retrieve an invoice, rather than enforcing an access-control decision tied to the requester and the specific order. Shared guest-customer records can further weaken ownership validation when they are used without an independent, unguessable authorization token or equivalent control.
Potential impact
- Unauthorized parties may access guest customer names and contact details
- Home or delivery addresses may be disclosed
- Telephone numbers and email addresses may be exposed
- Purchased items and order totals may be revealed
- Attackers could enumerate multiple guest orders if identifiers are predictable
- Exposed information could support phishing, fraud, or privacy violations
- Unauthorized parties may access guest customer names and contact details
- Home or delivery addresses may be disclosed
- Telephone numbers and email addresses may be exposed
- Purchased items and order totals may be revealed
- Attackers could enumerate multiple guest orders if identifiers are predictable
- Exposed information could support phishing, fraud, or privacy violations
General mitigation guidance
Mitigation generally focuses on enforcing object-level authorization for every invoice retrieval request.
Common defensive patterns include:
- Verify that the authenticated user or guest-specific capability is authorized for the requested order
- Use short-lived, high-entropy download tokens that are scoped to one order and purpose
- Avoid treating sequential or client-supplied order identifiers as access credentials
- Apply consistent authorization checks to guest and registered-customer workflows
- Return indistinguishable responses for unauthorized and nonexistent records where appropriate
- Limit invoice data to the minimum necessary and protect sensitive fields
- Apply least-privilege database and application permissions
- Rate-limit and monitor repeated invoice lookup attempts
Mitigation generally focuses on enforcing object-level authorization for every invoice retrieval request.
Common defensive patterns include:
- Verify that the authenticated user or guest-specific capability is authorized for the requested order
- Use short-lived, high-entropy download tokens that are scoped to one order and purpose
- Avoid treating sequential or client-supplied order identifiers as access credentials
- Apply consistent authorization checks to guest and registered-customer workflows
- Return indistinguishable responses for unauthorized and nonexistent records where appropriate
- Limit invoice data to the minimum necessary and protect sensitive fields
- Apply least-privilege database and application permissions
- Rate-limit and monitor repeated invoice lookup attempts
How teams detect issues like this
High-level detection can include:
- Static analysis and code review checks for download or invoice actions that query records directly from request parameters
- Searches for object lookups by order identifiers without adjacent ownership or capability validation
- Review of guest-order logic that uses shared customer identifiers
- Authorization tests covering unauthenticated, cross-account, and cross-order access attempts
- Web application monitoring for sequential or unusually broad order identifier requests
- Policy enforcement requiring object-level authorization for every sensitive resource endpoint
- Neutral automated review rules that flag direct access to customer or order records from untrusted identifiers
High-level detection can include:
- Static analysis and code review checks for download or invoice actions that query records directly from request parameters
- Searches for object lookups by order identifiers without adjacent ownership or capability validation
- Review of guest-order logic that uses shared customer identifiers
- Authorization tests covering unauthenticated, cross-account, and cross-order access attempts
- Web application monitoring for sequential or unusually broad order identifier requests
- Policy enforcement requiring object-level authorization for every sensitive resource endpoint
- Neutral automated review rules that flag direct access to customer or order records from untrusted identifiers
