CVE-2021-47923: OpenCart 3.0.3.8 Session Fixation Enables Account Takeover

Executive Summary

A critical session fixation vulnerability (CVE-2021-47923) has been identified in OpenCart 3.0.3.8, one of the most widely deployed open-source eCommerce platforms. The flaw carries a CVSS score of 9.8 and enables unauthenticated attackers to hijack any user session, including those of store administrators.

The vulnerability stems from OpenCart's failure to regenerate the OCSESSID session cookie after a successful authentication event. An attacker who pre-seeds a known session ID into a victim's browser can fully take over the authenticated session once the user logs in — a classic session fixation attack pattern.

All OpenCart deployments running version 3.0.3.8 or earlier that have not applied vendor patches are at risk.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

Session fixation attacks exploit a fundamental flaw in session lifecycle management: the server does not issue a new session ID when a user successfully authenticates. OpenCart 3.0.3.8's session handling for the OCSESSID cookie accepts externally supplied session values and retains them across authentication state transitions.

When a user logs in, the server should invalidate the pre-auth session and generate a fresh, unpredictable session ID. In this vulnerable version, OpenCart perpetuates the attacker-supplied session ID — effectively granting the attacker the victim's full authenticated session.

Attack Flow

1. Attacker identifies a target OpenCart store
2. Attacker generates or captures a valid OCSESSID value (e.g., by visiting the store)
3. Attacker delivers a link to the victim with the OCSESSID pre-set:
   - Via a crafted URL with the session ID in a query parameter accepted by the app
   - Or by exploiting a same-domain XSS to set the cookie directly
4. Victim visits the link and the OCSESSID is written to their browser
5. Victim authenticates to the store with their credentials
6. OpenCart creates an authenticated session under the attacker-known OCSESSID
7. Attacker uses the known OCSESSID to make authenticated requests as the victim
8. If victim is an admin, attacker gains full store administration access

Exploitation Conditions

• Target must run OpenCart 3.0.3.8 or earlier
• Attacker must be able to deliver the initial link/request to the victim (phishing, social engineering, or network position)
• Victim must log in after the session ID has been seeded
• No prior account credentials required for the attacker

Impact Assessment

Immediate Remediation

Step 1: Update OpenCart

Upgrade to the latest OpenCart version that resolves CVE-2021-47923. Consult the official OpenCart GitHub repository and changelog for the targeted patch.

# Check your current OpenCart version
grep -r "VERSION" /path/to/opencart/system/startup.php
 
# Review official releases
# https://github.com/opencart/opencart/releases

Step 2: Harden Session Management (Temporary Mitigation)

If immediate upgrade is not possible, implement session regeneration in the authentication controller:

// In catalog/controller/account/login.php — after successful authentication
// Force session ID regeneration on login
session_regenerate_id(true);
 
// In admin/controller/common/login.php
session_regenerate_id(true);

Step 3: Enforce Secure Cookie Attributes

Ensure the OCSESSID cookie is set with HttpOnly, Secure, and SameSite=Strict attributes to reduce the attack surface:

// In system/library/session.php or equivalent
setcookie(
    session_name(),
    session_id(),
    [
        'expires'  => 0,
        'path'     => '/',
        'domain'   => '',
        'secure'   => true,
        'httponly' => true,
        'samesite' => 'Strict',
    ]
);

Step 4: Audit Active Sessions for Compromise

-- Review active sessions in the database
SELECT session_id, data, expire FROM oc_session ORDER BY expire DESC LIMIT 50;
 
-- Identify sessions with suspicious or duplicate IDs
SELECT session_id, COUNT(*) as count FROM oc_session GROUP BY session_id HAVING count > 1;
 
-- Purge all active sessions to force re-authentication
TRUNCATE TABLE oc_session;

Detection Indicators

Post-Remediation Checklist

1. Update OpenCart to the latest patched version
2. Invalidate all active sessions — purge the session table to force re-authentication
3. Reset all admin passwords for store administrators
4. Enable two-factor authentication on admin accounts if the plugin/version supports it
5. Review recent admin activity logs for unauthorized changes
6. Audit customer order history for unexpected modifications
7. Enable Secure and HttpOnly flags on all cookies
8. Deploy a WAF with session-fixation detection rules (Cloudflare, ModSecurity)
9. Monitor for re-exploitation with anomalous session activity alerts
10. Notify affected customers if evidence of account compromise is found

References

• NVD — CVE-2021-47923
• OpenCart GitHub Repository
• CWE-384 — Session Fixation
• OWASP — Session Fixation