CVE-2024-39319: Aimeos Frontend Controller Auth Bypass

CVE-2024-39319 Overview

CVE-2024-39319 is an insecure direct object reference (IDOR) vulnerability in the aimeos/ai-controller-frontend package, the frontend controller for Aimeos e-commerce projects. The flaw allows an unauthenticated or authenticated attacker to disable subscriptions and reviews belonging to other customers by supplying arbitrary object identifiers. The controller methods failed to verify that the requested resource belonged to the current user before performing modification actions. This weakness maps to CWE-639: Authorization Bypass Through User-Controlled Key. Fixed releases are 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15.

Critical Impact
An attacker can cancel another customer's active subscriptions and delete their product reviews by manipulating identifiers in frontend controller requests.

Affected Products

Aimeos ai-controller-frontend versions prior to 2024.4.2 (2024.x branch)
Aimeos ai-controller-frontend versions prior to 2023.10.9, 2022.10.8, and 2021.10.8
Aimeos ai-controller-frontend versions prior to 2020.10.15

Discovery Timeline

2024-09-26 - CVE-2024-39319 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39319

Vulnerability Analysis

The Aimeos frontend controller exposes methods that operate on customer-owned resources such as subscriptions and product reviews. Prior to the fix, the cancel() method in Controller/Frontend/Subscription/Standard.php retrieved a subscription item by identifier without confirming ownership. Similarly, the delete() method in Controller/Frontend/Review/Standard.php built a filter against review IDs alone. An attacker supplying an identifier owned by another user could invoke these methods against unrelated records. The result is unauthorized state changes: subscription cancellations and review deletions across the customer base of any Aimeos-based storefront.

Root Cause

The root cause is missing ownership enforcement on server-side controller actions. Access control relied on the assumption that clients would only submit identifiers for their own records. Direct object references were trusted without a secondary check tying the identifier to the authenticated session user via context()->user().

Attack Vector

Exploitation occurs over the network against the storefront endpoints that route into the frontend controller. The attacker enumerates or guesses numeric identifiers for reviews or subscription records and issues cancel or delete requests. No privileged role is required. Because the impact is limited to integrity changes on other customers' data, confidentiality and availability of the store itself remain intact.

php

// Patch: Controller/Frontend/Review/Standard.php
// Ownership check added to the review deletion filter
public function delete( $ids ) : Iface
{
    $ids = (array) $ids;
-   $filter = $this->manager->filter()->add( ['review.id' => $ids] );
+   $filter = $this->manager->filter()->add( ['review.id' => $ids, 'review.customerid' => $this->context()->user()] );
    $this->manager->delete( $this->manager->search( $filter->slice( 0, count( $ids ) ) )->toArray() );

    return $this;
}
// Source: https://github.com/aimeos/ai-controller-frontend/commit/2ad5c062a629af374da470a319914c321c9bfee2

php

// Patch: Controller/Frontend/Subscription/Standard.php
// Retrieval routed through object() which enforces the user-scoped decorator chain
public function cancel( string $id ) : \Aimeos\MShop\Subscription\Item\Iface
{
-   $item = $this->manager->get( $id );
+   $item = $this->object()->get( $id );
+
    $item = $item->setDateEnd( $item->getDateNext() ?: date( 'Y-m-d' ) )
        ->setReason( \Aimeos\MShop\Subscription\Item\Iface::REASON_CANCEL );
}
// Source: https://github.com/aimeos/ai-controller-frontend/commit/53eebdc51fae34440dfd768a7811c169c7779aa9

Detection Methods for CVE-2024-39319

Indicators of Compromise

Unexpected subscription cancellations reported by customers, with reason set to REASON_CANCEL and dateend matching the current day.
Deletion events for reviews whose customerid differs from the session user recorded in application logs.
Sequential or enumerated identifiers appearing in POST requests to subscription and review endpoints from a single source.

Detection Strategies

Compare the authenticated session identity against the customerid field of any subscription or review affected by a cancel or delete action.
Alert on high-rate access to Aimeos frontend endpoints such as subscription/cancel and review/delete from a single IP or account.
Review database audit logs for subscription and review table modifications where the acting user does not match the record owner.

Monitoring Recommendations

Enable verbose logging on the ai-controller-frontend package and forward events to a centralized SIEM for correlation.
Track the installed version of aimeos/ai-controller-frontend in software inventory to identify hosts still running vulnerable releases.
Monitor for post-exploitation customer support tickets referencing missing reviews or unexpected subscription terminations.

How to Mitigate CVE-2024-39319

Immediate Actions Required

Upgrade aimeos/ai-controller-frontend to 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, or 2020.10.15 depending on the branch in use.
Audit subscription and review tables for unauthorized cancellations or deletions since the vulnerable version was deployed.
Restore affected records from backups and notify impacted customers where integrity loss is confirmed.

Patch Information

The maintainers released fixes across all supported branches. The relevant commits enforce that subscription retrieval passes through the user-scoped decorator ($this->object()->get()) and that review deletion filters include review.customerid matched to context()->user(). See the GitHub Security Advisory GHSA-rw3j-574h-mrcq and the review controller patch commit 2ad5c06.

Workarounds

If patching is not immediately possible, override the affected controller methods in a project-level decorator that enforces customerid equality with the authenticated user before delegating to the parent implementation.
Restrict access to subscription and review endpoints to authenticated sessions only and rate-limit requests to slow enumeration attempts.

bash

# Update via Composer to a fixed release for the 2024.x branch
composer require aimeos/ai-controller-frontend:^2024.4.2

# Verify the installed version after upgrade
composer show aimeos/ai-controller-frontend | grep versions