CVE-2025-11699
📋 TL;DR
nopCommerce versions 4.70 and prior, and specifically version 4.80.3, fail to properly invalidate session cookies after logout or session termination. This allows attackers with a valid session cookie to access privileged endpoints like /admin even after the legitimate user has logged out, enabling session hijacking. All nopCommerce installations using affected versions are vulnerable.
💻 Affected Systems
- nopCommerce
📦 What is this software?
Nopcommerce by Nopcommerce
Nopcommerce by Nopcommerce
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the nopCommerce instance, allowing them to modify products, steal customer data, change configurations, or deploy malicious code.
Likely Case
Session hijacking leading to unauthorized access to user accounts, potential data theft, and privilege escalation to administrative functions.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and monitoring for anomalous session activity.
🎯 Exploit Status
Exploitation requires obtaining a valid session cookie through other means (XSS, MITM, etc.), but once obtained, session hijacking is trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Any version above 4.70 except 4.80.3, or specifically version 4.80.4 and above
Vendor Advisory: https://www.nopcommerce.com/en/release-notes?srsltid=AfmBOoravPKjN19pm_XZbXZ7GvPhkt8cxlK6794BJRZlY5RxJU_yNoTT
Restart Required: Yes
Instructions:
1. Backup your nopCommerce installation and database. 2. Download the latest nopCommerce version from the official website. 3. Replace the existing files with the updated version. 4. Restart the application/web server. 5. Verify the update by checking the version in the admin panel.
🔧 Temporary Workarounds
Implement Session Timeout
allConfigure application or web server to enforce session timeout after inactivity
For IIS: Set sessionState timeout in web.config to a lower value (e.g., 20 minutes)
For Apache/Nginx: Configure session timeout in server configuration
Force Cookie Regeneration
allModify application code to regenerate session cookies on login/logout
Implement custom session management that invalidates old cookies
🧯 If You Can't Patch
- Implement network segmentation to restrict access to admin interfaces
- Deploy web application firewall (WAF) with session hijacking protection rules
🔍 How to Verify
Check if Vulnerable:
Check nopCommerce version in admin panel at /admin or examine web.config/assembly version. If version is ≤4.70 or exactly 4.80.3, system is vulnerable.Check Version:
Check Admin panel → Configuration → System Information, or examine the nopCommerce.dll file versionVerify Fix Applied:
After patching, verify version is above 4.70 and not 4.80.3. Test logout functionality to ensure session cookies are invalidated.📡 Detection & Monitoring
Log Indicators:
- Multiple successful admin logins from different IP addresses using same session ID
- Admin access attempts with expired or old session cookies
- Unusual session duration patterns
Network Indicators:
- Repeated requests to /admin endpoints with same session cookie over extended periods
- Session cookies being reused after logout events
SIEM Query:
source="web_logs" AND (uri_path="/admin" OR uri_path="/admin/*") AND session_id=* | stats count by session_id, src_ip | where count > threshold