Horizon Alert
Summary of the vulnerability and why it matters
An unauthenticated SQL injection vulnerability in the Vendure Shop API could allow attackers to run arbitrary commands against your database. This issue is critical because it could lead to significant data compromise.
- Affects unauthenticated access.
- Could allow database takeover.
- Impacts all supported databases.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this flaw by sending specially crafted requests to the Vendure Shop API, targeting the `languageCode` parameter. By injecting malicious SQL code, an attacker could gain unauthorized access to sensitive data or disrupt database operations. This vulnerability affects all supported database backends.
- Unauthenticated API access needed.
- Shop API `languageCode` parameter targeted.
- SQL injection allows data exfiltration.
Live Threat
Current exploitation, exposure, and threat context
This SQL injection vulnerability in Vendure's Shop API, affecting versions prior to 2.3.4, 3.5.7, and 3.6.2, presents a significant risk due to its unauthenticated nature and direct impact on database integrity. Attackers are likely to target this because it allows for arbitrary SQL execution without needing any prior access to the system. The vulnerability's presence in a widely used commerce platform's public-facing API further increases its attractiveness for exploitation.
- Publicly exposed API endpoint.
- Affects database operations directly.
- Exploitable without authentication.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize blocking unauthenticated SQL injection in the Vendure Shop API, especially given its public-facing nature and the critical severity of this vulnerability. Investigate logs for signs of exploitation targeting the `languageCode` parameter.
- Apply Vendure versions 2.3.4, 3.5.7, or 3.6.2.
- Implement the provided hotfix to validate `languageCode`.
- Monitor traffic for suspicious SQL query patterns.
