Ecommerce Template
Monthly
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecommerce Template (all revisions before commit ec97209) to forcibly expire the entire storefront product cache, driving near-zero-cost cache thrash and availability degradation. The action lives in src/app/actions.ts under a file-scope "use server" directive and calls updateTag("products") with no session or role check, unlike the read-only actions in the same file; because two client components under src/components/admin import it, its Server Action id is compiled into a public /_next/static chunk that the proxy.ts admin middleware does not gate, so any remote user can harvest the id and POST it directly. Impact is strictly availability-scoped (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reachable condition is deployment-dependent: it matters when cacheComponents is enabled and storefront pages are served from 'use cache' entries tagged 'products' with an hours-long cacheLife, an open-source self-hosted template configuration chosen by each operator. No public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation.
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecommerce Template (all revisions before commit ec97209) to forcibly expire the entire storefront product cache, driving near-zero-cost cache thrash and availability degradation. The action lives in src/app/actions.ts under a file-scope "use server" directive and calls updateTag("products") with no session or role check, unlike the read-only actions in the same file; because two client components under src/components/admin import it, its Server Action id is compiled into a public /_next/static chunk that the proxy.ts admin middleware does not gate, so any remote user can harvest the id and POST it directly. Impact is strictly availability-scoped (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reachable condition is deployment-dependent: it matters when cacheComponents is enabled and storefront pages are served from 'use cache' entries tagged 'products' with an hours-long cacheLife, an open-source self-hosted template configuration chosen by each operator. No public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation.