Security: Multiple authorization vulnerabilities (3 HIGH, 1 MEDIUM)

[lighthousekeeper1212]

Summary

Security audit of Veniqa identified 4 authorization vulnerabilities in the shopping server, primarily cross-user IDOR issues caused by MongoDB queries not scoped to the authenticated user.

Findings

1. HIGH: Cross-User Cart Item Deletion IDOR

File: shopping-server/services/shoppingService.js:212

deleteFromCart uses User.findOneAndUpdate({'cart.items._id': cartItemId}, ...) which searches across ALL users. Any authenticated user who knows a cart item ID can delete items from another user's cart.

Comparison: addToCart (line 19) scopes to User.findOne({email: userObj.email}). updateCart (line 157) and getCart (line 102) also scope by email. Only deleteFromCart uses an unscoped query.

Fix: User.findOneAndUpdate({email: userObj.email, 'cart.items._id': cartItemId}, ...)

2. HIGH: Cross-User Address Deletion IDOR

File: shopping-server/services/userService.js:117

Same pattern. deleteAddress uses User.findOneAndUpdate({'addresses._id': addressId}, ...) without scoping.

Comparison: addNewAddress (line 12), updateAddress (line 68), getAddresses (line 53) all scope by email.

Fix: Add {email: userObj.email} to the query filter.

3. HIGH: Checkout Completion Without User Ownership Verification

File: shopping-server/services/orderService.js:433, shopping-server/controllers/orderController.js:96

completeCheckout converts a checkout to a finalized order without ANY user ownership check. The controller never passes req.user to the service.

Comparison: ALL other checkout endpoints properly scope: createCheckout, completeCheckoutUsingCard, completeCheckoutUsingKhalti, completeCheckoutUsingStripePaymentInstant, createPaymentToken, isCheckoutValid — all pass req.user and check user_email.

Fix: Pass req.user and add user_email: userObj.email to the checkout query.

4. MEDIUM: Email Confirmation Bypass

File: shopping-server/authentication/passportAuth.js:57-63

Email confirmation check is commented out. Users sign up with any email and immediately access everything.

Comparison: Management server's Passport strategy properly enforces the approved check.

Impact

Cross-user cart manipulation, address deletion, and checkout hijacking via IDOR.

Disclosure

This report was generated during a systematic open-source security audit. Happy to discuss findings or assist with fixes.