Authorization Bypass in Shopper Framework CollectionProducts Component

Shopper framework versions prior to 2.9.2 are vulnerable to an authorization bypass in the CollectionProducts Livewire component. The vulnerability stems from two primary issues: the collection property is not locked, allowing arbitrary modification of the collection ID by the client, and the delete and bulk-delete actions lack proper authorization checks. An authenticated user possessing only the browse_collections role can manipulate Livewire network payloads to target and empty any collection within the store's database. This vulnerability effectively escalates a user's privileges, allowing them to perform destructive actions against storefront catalog groupings and promotions without the necessary edit_collections permissions. This impacts organizations relying on Shopper for e-commerce catalog management, as an attacker can systematically detach products from collections, disrupting site functionality and promotional campaigns.

Attack Chain

1. Attacker authenticates to the admin panel using valid, low-privileged credentials (e.g., browse_collections only).
2. Attacker inspects the CollectionProducts Livewire component to identify the target collection ID and the component snapshot structure.
3. Attacker captures the XSRF token and active session cookie to prepare the authenticated network request.
4. Attacker constructs a malicious POST request targeting the /shopper/livewire/update endpoint.
5. Attacker replaces the legitimate collection ID within the Livewire component snapshot data with an arbitrary target collection ID.
6. Attacker invokes the callBulkAction method within the payload, specifying the 'delete' action and a list of product IDs to detach.
7. The server processes the request without verifying the caller's authorization or validating the component state.
8. Targeted products are detached from the specified collection, resulting in a loss of catalog integrity.

Impact

The successful exploitation of this vulnerability allows unauthorized users to detach products from any collection in the database. This causes immediate disruption to storefront catalog groupings, landing pages, and promotional activities linked to these collections. Because the attacker can target any collection ID, the scope of impact is the entire catalog database rather than just the collections associated with their assigned permissions.

Recommendation

1. Upgrade shopper/framework to version 2.9.2 or later immediately to patch the missing authorization and property locking.
2. Audit administrative roles to ensure the least-privilege principle is applied and monitor for unauthorized callBulkAction requests in server logs.
3. Validate that all Livewire components sensitive to user input use the #[Locked] attribute to prevent client-side property modification.