CVE-2024-48914

What it actually does

Vendure versions before 3.0.5 and 2.3.3 contain a path traversal flaw in the asset server plugin. A remote, unauthenticated attacker can craft asset retrieval URLs containing traversal sequences such as parent-directory references or encoded equivalents, causing the server to read files outside the intended asset directory. This can expose local files readable by the Vendure process, including configuration files, environment files, secrets, source code, credentials, and deployment metadata. The same vulnerable code path can also be abused with malformed URI input to crash the server process, creating a denial-of-service condition. The CVSS 9.1 rating reflects network reachability, no authentication requirement, high confidentiality impact, and high availability impact.

Why it matters to the business

A vulnerable Vendure commerce deployment can leak sensitive operational secrets and customer-facing platform configuration, potentially leading to account takeover of connected services, payment or fulfillment system exposure, cloud credential compromise, and broader infrastructure intrusion. Because the issue affects an e-commerce platform component that may be internet-facing and the exploit maturity is listed as weaponized with a high EPSS probability, organizations should treat exposed instances as high-priority remediation targets even though the issue is not currently listed in CISA KEV and is not known from the provided data to be ransomware-associated.

How an attack unfolds

An attacker first identifies a Vendure instance exposing the asset server plugin, usually by probing common asset-serving routes and observing Vendure-specific behavior. They then send specially crafted HTTP requests to the asset endpoint that include directory traversal patterns or encoded traversal patterns. If the server fails to normalize and restrict the requested path to the configured asset directory, it resolves the attacker-controlled path against the local filesystem and returns arbitrary readable files. The attacker typically starts with harmless proof files and then attempts to retrieve high-value files such as environment variable files, application configuration, package metadata, container secrets, cloud credential files, private keys, or logs. Any secrets recovered may be used for follow-on access to databases, object storage, mail providers, payment integrations, CI/CD systems, or cloud accounts. Separately, the attacker may submit malformed URI sequences to the same code path to trigger an exception or crash, causing service instability or outage.

How to fix it

Upgrade Vendure to a patched release immediately: use Vendure 3.0.5 or later for the 3.x branch, or Vendure 2.3.3 or later for the 2.x branch. For source-based deployments, ensure the code includes the upstream fix commit 483dca6a13f4708ae9fc60f5ca8239aafcab0edb. Rebuild and redeploy application containers or packages after upgrading; do not assume dependency lockfile changes are active until the running service is replaced. If immediate upgrade is not possible, reduce exposure by placing the asset server behind a WAF or reverse proxy rule that blocks traversal patterns in asset URLs, including encoded variants; add application middleware to reject URLs containing `/../` and equivalent encodings; and prefer object storage-backed assets such as S3 or MinIO instead of serving from the local filesystem. Ensure the Vendure process runs with least-privilege filesystem permissions and cannot read secrets that are not strictly required. Rotate credentials that may have been stored in local environment files, configuration files, container mounts, or other files readable by the application if exploitation is suspected.

How to confirm the fix worked

Confirm the deployed Vendure version is 3.0.5 or later, 2.3.3 or later, or contains commit 483dca6a13f4708ae9fc60f5ca8239aafcab0edb. Validate the running artifact, not only the repository, by checking package metadata, container image contents, lockfiles, and application startup logs. Test the asset endpoint with benign traversal probes in a controlled environment and confirm the server returns a rejection such as 400 or 403 rather than file contents or a 500 crash. Verify encoded traversal variants are also blocked by the application, reverse proxy, or WAF. Confirm malformed URI requests no longer crash the Vendure process. Review filesystem permissions to ensure the application user cannot read unnecessary sensitive files. If object storage is used, verify the local asset filesystem path is not exposed for serving arbitrary local files.

Typical attack path

1. Discover an internet-accessible Vendure storefront, admin API, or asset-serving endpoint.
2. Confirm the presence of the Vendure asset server plugin by requesting normal asset URLs and observing successful static file behavior.
3. Send traversal-style asset requests using parent-directory sequences or encoded equivalents.
4. Validate whether files outside the asset directory can be read by requesting predictable low-risk local files or application files.
5. Retrieve sensitive files readable by the Vendure process, such as environment files, configuration files, source files, logs, secrets, or deployment metadata.
6. Use any recovered credentials or tokens to access connected systems such as databases, object storage, cloud services, payment integrations, or internal APIs.
7. Optionally send malformed URI requests to crash the server and disrupt commerce operations or distract defenders.

How to detect it

Review HTTP access logs from the application, reverse proxy, CDN, load balancer, and WAF for requests to Vendure asset-serving paths containing directory traversal sequences, encoded dot-dot-slash patterns, double-encoded traversal strings, null-byte-like encodings, or requests for sensitive local filenames. Pay special attention to requests that returned HTTP 200 with unusually small text responses, HTTP 500 errors, or were followed by application crashes or restarts. Review Vendure and Node.js application logs for URI decoding exceptions, malformed URI errors, uncaught exceptions, process exits, container restarts, and file read errors around the same timestamps. Search for requests attempting to access files such as `.env`, `/etc/passwd`, `/proc/self/environ`, configuration files, private keys, package metadata, or cloud credential paths. If file disclosure is suspected, correlate source IPs with subsequent authentication events or API calls against connected systems, including databases, object storage, payment providers, email providers, and cloud control planes. Because successful exploitation may only appear as normal HTTP GET responses, absence of obvious error logs does not rule out compromise; access log review is essential.

• /../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2e%2e%2F
• %252e%252e%252f
• %252e%252e%252F
• %2e%2e/
• ..%5c
• %2e%2e%5c
• /assets/../
• /assets/%2e%2e%2f
• /assets/..%2f
• /etc/passwd
• /proc/self/environ
• /.env
• /.env.local
• /.env.production
• /config.json
• /package.json
• /package-lock.json
• /yarn.lock
• /pnpm-lock.yaml
• /id_rsa
• /.ssh/id_rsa
• /root/.ssh/id_rsa
• /home/node/.ssh/id_rsa
• /var/run/secrets/kubernetes.io/serviceaccount/token
• URIError: URI malformed
• Failed to decode param
• malformed URI sequence

What your security team should do

• Prioritize remediation for all internet-facing Vendure deployments because the vulnerability is unauthenticated, high-severity, and listed as weaponized with a high EPSS score.
• Upgrade to Vendure 3.0.5 or later, 2.3.3 or later, or a build containing commit 483dca6a13f4708ae9fc60f5ca8239aafcab0edb.
• Add temporary WAF or reverse proxy controls to block traversal and malformed URI patterns against asset-serving routes until all instances are patched.
• Search historical web, reverse proxy, CDN, WAF, and application logs for traversal probes, encoded traversal attempts, sensitive filename requests, and malformed URI errors.
• If suspicious file reads are found, assume exposed local secrets may be compromised and rotate application secrets, database credentials, API keys, object storage keys, payment integration credentials, and cloud credentials as applicable.
• Harden Vendure runtime permissions so the application process can only read required application and asset files.
• Prefer S3, MinIO, or equivalent object storage for assets where operationally feasible, reducing dependence on local filesystem serving.
• Add regression tests or security tests that verify asset URLs cannot escape the configured asset directory.