FleetCart 4.1.1 - Information Disclosure

mediumseverity

5.3CVSS score

18.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the "Razorpay" "razorpayKeyId".

Impact

Unauthenticated attackers can access sensitive configuration data including Razorpay payment gateway API keys through information disclosure in redirect responses.

Fix

Update FleetCart to a version later than 4.1.1 that addresses this information disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/en/products?query=123
Positive when: contains_all(body, "razorpayKeyId:", "loggedIn:", "storeName:") and status_code == 200 AND not contains "razorpayKeyId: ''"

Run it with nuclei: nuclei -id CVE-2024-5230 -u <target>

The full check

id: CVE-2024-5230
info:
  name: FleetCart 4.1.1 - Information Disclosure
  author: s4e-io
  severity: medium
  description: |
    Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the "Razorpay" "razorpayKeyId".
  impact: |
    Unauthenticated attackers can access sensitive configuration data including Razorpay payment gateway API keys through information disclosure in redirect responses.
  remediation: |
    Update FleetCart to a version later than 4.1.1 that addresses this information disclosure vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5230
    - https://packetstormsecurity.com/files/178770/FleetCart-4.1.1-Information-Disclosure.html
    - https://codecanyon.net/item/fleetcart-laravel-ecommerce-system/23014826
    - https://vuldb.com/?ctiid.265981
    - https://vuldb.com/?id.265981
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-5230
    cwe-id: CWE-200
    epss-score: 0.18768
    epss-percentile: 0.97302
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"FleetCart"
  tags: cve,cve2024,packetstorm,cms,fleetcart,info-leak,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/en/products?query=123"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "razorpayKeyId:", "loggedIn:", "storeName:")'
          - "status_code == 200"
        condition: and

      - type: word
        words:
          - "razorpayKeyId: ''"
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from