CVE-2025-51605
📋 TL;DR
Shopizer 3.2.7 has a CORS misconfiguration that reflects client-supplied Origin headers without validation while allowing credentials. This allows malicious websites to make authenticated cross-origin requests and steal sensitive data from logged-in users. All Shopizer 3.2.7 deployments with default CORS settings are affected.
💻 Affected Systems
- Shopizer
📦 What is this software?
Shopizer by Shopizer
⚠️ Risk & Real-World Impact
Worst Case
Attackers can steal session cookies, authentication tokens, and sensitive user data from all authenticated users via malicious websites, leading to full account compromise and data exfiltration.
Likely Case
Attackers create phishing sites that silently make authenticated requests to vulnerable Shopizer instances, stealing user session data and personal information.
If Mitigated
With proper CORS validation, only trusted origins can make credentialed cross-origin requests, preventing unauthorized data access.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious site) but the technical complexity is minimal. Public PoC demonstrates the attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check for official Shopizer patch or update
2. If patch available, apply following vendor instructions
3. Verify CORS configuration after patching
🔧 Temporary Workarounds
Implement CORS Origin Whitelist
allConfigure the server to validate Origin headers against a whitelist of trusted domains instead of reflecting client input.
Modify CORS configuration to validate Origin headers
Set Access-Control-Allow-Origin to specific trusted domains only
Disable Access-Control-Allow-Credentials
allPrevent credentialed cross-origin requests by disabling Access-Control-Allow-Credentials header.
Set Access-Control-Allow-Credentials: false in server configuration
🧯 If You Can't Patch
- Implement WAF rules to block malicious Origin headers
- Use reverse proxy to validate and sanitize CORS headers
🔍 How to Verify
Check if Vulnerable:
Send HTTP request with arbitrary Origin header and check if server reflects it in Access-Control-Allow-Origin while Access-Control-Allow-Credentials is true.Check Version:
Check Shopizer version in admin panel or application metadataVerify Fix Applied:
Test that Access-Control-Allow-Origin only contains whitelisted domains and Access-Control-Allow-Credentials is false or properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual cross-origin requests
- Requests with suspicious Origin headers
- Multiple failed CORS preflight requests
Network Indicators:
- CORS requests from unexpected domains
- Access-Control-Allow-Origin headers containing user-supplied values
SIEM Query:
http.headers.origin:* AND http.headers.access-control-allow-origin:* AND NOT http.headers.access-control-allow-origin:null