CVE-2024-31205 Saleor CSRF bypass in refreshToken mutation
Attackers can bypass CSRF validation in the refreshToken mutation to obtain valid access tokens, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-31205?
CVE-2024-31205 is a medium-severity vulnerability in saleor, published on 8 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.
Weakness: CWE-352
Which versions are affected by CVE-2024-31205?
It affects 1 product.
Products include Saleor Saleor.
How do I fix CVE-2024-31205?
No fix has been published for CVE-2024-31205 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-31205 being exploited?
There is no known exploitation of CVE-2024-31205 in the wild and no public exploit code.
Other vulnerabilities in saleor
- CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
- CVE-2026-23499 Saleor vulnerable to stored XSS via Unrestricted File Upload
- CVE-2026-33756 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
- CVE-2026-35401 Saleor has a resource exhaustion vulnerability in GraphQL queries
- CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields
Sources
Also known as GHSA-ff69-fwjf-3c9w.