registry / @vtex/faststore-plugin-buyer-portal / 2.0.12

@vtex/faststore-plugin-buyer-portal@2.0.12

A plugin for faststore with buyer portal

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Authenticated visits to two plugin routes load hardcoded external Vercel iframes and transmit VTEX authentication material through `postMessage`. The package exposes reusable session credentials and related user/account context to remote applications outside the configured store origin.

Static reason

No blocking static signals were detected.

Trigger

Authenticated user opens `/pvt/organization-account/buyer-organization-manager` or `/pvt/organization-account/order-entry`.

Impact

Remote iframe operators can receive VTEX auth tokens, session/segment values, and account or user context, enabling account/session abuse.

Mechanism

Cross-origin iframe credential forwarding via postMessage.

Attack narrative

On authenticated agent-route visits, page code extracts the VTEX auth-cookie value. Each layout embeds a hardcoded Vercel-hosted iframe and sends the token through `postMessage`; the order-entry path additionally sends session, segment, account, customer/user IDs, and quote context. Origin checks limit delivery to those remote iframe origins but do not prevent those remote applications from receiving and using the credentials.

Rationale

This is concrete cross-origin credential and session-data exfiltration to hardcoded external hosts, not merely ordinary store API traffic. No install-time mutation is needed for the runtime credential exposure.

Evidence

package.json.husky/pre-commitsrc/pages/buyer-organization-manager.tsxsrc/pages/order-entry.tsxsrc/features/b2b-agent/layouts/B2BAgentLayout/B2BAgentLayout.tsxsrc/features/order-entry/layouts/OrderEntryLayout.tsx

@vtex/faststore-plugin-buyer-portal@2.0.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code