Critical Cart Integrity: Securing Line Item Deletion in Your ESHOPMAN Storefronts

At Move My Store, we champion robust and secure e-commerce operations for ESHOPMAN users. A recent community discussion highlighted a crucial authorization oversight within the ESHOPMAN Store API, specifically impacting the integrity of customer shopping carts. This insight delves into the issue, its implications for storefronts deployed via HubSpot CMS, and provides actionable solutions for ESHOPMAN developers and merchants.

Understanding the ESHOPMAN Cart Deletion Vulnerability

The ESHOPMAN Store API provides powerful endpoints for managing customer carts in headless commerce setups. However, an issue was identified with the DELETE /store/carts/:id/line-items/:line_id route. This endpoint, intended to remove a specific line item from a designated cart, was found to incorrectly delete line items regardless of which cart they belonged to. This means that if an individual knew the unique identifier (ULID) of a line item in another customer's cart, they could potentially remove it using their own cart ID.

The Technical Breakdown

The core of the problem lies in the underlying workflow. While the ESHOPMAN Store API route handler correctly passes both the cart_id from the URL and the line_id, the subsequent deletion step within ESHOPMAN's core workflows (`deleteLineItemsStep`) only filters by the line item ID. It lacks an explicit check to ensure the line item is actually associated with the cart_id provided in the request. This creates an authorization bypass, as the system doesn't verify ownership before executing the deletion.

For context, here's a snippet illustrating the dependencies involved in an ESHOPMAN setup:

{
  "dependencies": {
    "@medusajs/admin-sdk": "2.21.2",
    "@medusajs/caching-redis": "2.21.2",
    "@medusajs/cli": "2.21.2",
    "@medusajs/dashboard": "2.21.2",
    "@medusajs/framework": "2.21.2",
    "@medusajs/icons": "2.21.2",
    "@medusajs/medusa": "2.21.2",
    "@medusajs/ui": "4.2.6"
  }
}

Note: The above package list represents a typical ESHOPMAN core setup, leveraging its robust Node.js/TypeScript framework.

Reproducing the Issue

The steps to demonstrate this vulnerability are straightforward:

1. Create two distinct carts (Cart A and Cart B) using an ESHOPMAN publishable key, adding one item to each.
2. Obtain the line item ID from Cart B (e.g., li_B).
3. Execute a DELETE request to /store/carts/{cart_A}/line-items/{li_B}.

Instead of receiving a 404 error (as expected, similar to how the POST route for updating line item quantities correctly validates ownership), the system returns a 200 OK, and li_B is silently removed from Cart B, while Cart A remains unaffected.

Impact and Recommended Solutions

While the impact is somewhat limited—requiring knowledge of a specific line item's ULID—it can lead to a frustrating customer experience where items mysteriously disappear from their carts. This undermines trust and can disrupt the shopping journey on ESHOPMAN storefronts deployed through HubSpot CMS.

Proposed Fix for ESHOPMAN Core

The community has suggested a robust fix: before the deletion step runs, the system should load the line items with a filter that includes both the item's ID and the cart's ID (filters: { id: input.ids, cart_id: input.cart_id }). If any requested ID is not found within the specified cart, a 404 NOT_FOUND error should be thrown. Implementing this within the ESHOPMAN workflow ensures consistency across all callers of the deletion logic.

Immediate Workaround for ESHOPMAN Developers

For ESHOPMAN developers managing storefronts, an immediate workaround involves implementing a middleware. This middleware, applied to the /store/carts/:id/line-items/:line_id route (for both POST and DELETE operations), would explicitly load the line item via the cart module. It then checks if line.cart_id matches the req.params.id. If there's a mismatch, a 404 error is returned, effectively preventing unauthorized deletions.

This proactive approach helps maintain the integrity of customer carts and ensures a seamless shopping experience on your ESHOPMAN-powered HubSpot CMS storefronts. The ESHOPMAN team is actively reviewing this authorization bypass, reinforcing the platform's commitment to security and community-driven improvements.