32

The order creation endpoint in the Supermarket platform (master branch) contains a critical missing authentication vulnerability. The endpoint POST /order/manage/save accepts userId as a form field and creates orders under that user's identity without any session/ticket validation. This allows unauthenticated attackers to inject arbitrary "ghost orders" under any victim's name, polluting their order history, disrupting auditing/accounting, and interfering with downstream fulfillment workflows. Note: This is the only vulnerability among the three new findings that remains undisclosed (0-day) after thorough CVE/GHSA/GitHub issue verification.

#Details The vulnerable endpoint passes the client-supplied userId and order details directly to the service layer without any authentication or ownership validation. The gateway configuration ( zuul-gateway/src/main/resources/application.properties ) does not include /order/** in the authentication check list ( custom.uri.check or custom.uri.forbidden ), making the order service externally reachable without credentials. The backend money validation ( CartService.getMoney ) itself uses the attacker-supplied userId to query the victim's shopping cart – meaning the "business validation" is fully compromised by the same attacker-controlled parameter. Verified with real Controller/Service/Mapper code, real frontend field set from mycart.html , and in-memory cart service replicating real getMoney logic.

Root Cause Analysis (Code Audit):

1. Controller – No Authentication Check

The controller accepts the Order object (including userId ) directly from the request body and passes it to the service layer without reading any session/ticket.

2. Service – No Ownership Validation, Uses Attacker-Controlled userId for Money Check

3. Cart Service – Money Validation Uses Attacker-Supplied userId

The "business validation" (money check) is fully compromised because it queries the victim's shopping cart using the attacker-controlled userId , then validates against the attacker-supplied orderMoney .

4. Mapper – Inserts Order with Attacker-Controlled userId

The entire call chain contains no session/ticket reading or ownership validation — userId comes entirely from the client and is used for: (a) money validation, (b) order insertion, and (c) querying the victim's shopping cart.

5. Gateway – Order Paths Not Protected

order/src/main/java/com/supermarket/order/controller/OrderController.java

order/src/main/java/com/supermarket/order/service/impl/OrderServiceImpl.java

cart/src/main/java/com/supermarket/cart/service/impl/CartServiceImpl.java

order/src/main/resources/mappers/OrderMapper.xml

zuul-gateway/src/main/resources/application.properties