Optimizely Configured Commerce before 5

In Optimizely Configured Commerce versions before 5.2.2408 on both the STS and LTS branches, some resource requests placed the authenticated session token in the URL query string instead of keeping it out of the address bar. That means the token can bleed into browser history, screenshots, proxy logs, referrer headers, shared-device traces, and any monitoring stack that records full URLs. If an attacker gets that token before it expires, they can replay the victim's authenticated session.

The raw AV:N/PR:N/UI:N scoring is too generous for what defenders actually face. Attackers do not get a session out of thin air; they need a second failure first: access to logs, a leaked URL, a shared workstation, a malicious browser extension, or some other path to the token. Optimizely's own advisory labeled the issue Medium 5.9, and that tracks reality better than the higher 7.5 enrichment score because the real-world chain has meaningful friction.

Why this verdict

• Start from 7.5, then subtract for the missing first mile: the attacker still needs to steal a live session token from logs, history, referrers, or a shared device before replay is possible.
• This is often post-initial-access or adjacent visibility: needing internal log access, browser artifacts, support-ticket leakage, or shared-endpoint access implies another compromise stage or at least another control failure.
• Blast radius is usually account-scoped: the impact can be serious for a privileged buyer/admin, but it is still bounded by the victim session rather than giving server-side code execution or tenant-wide takeover by default.

Why not higher?

There is no evidence in reviewed sources of KEV listing, mass scanning, or public weaponization. More importantly, the CVSS view hides the real prerequisite: a valid token must first leak somewhere an attacker can reach, and that materially narrows both exploitability and exposed population.

Why not lower?

This is still a genuine authentication-material exposure bug, not cosmetic hygiene. On commerce platforms, a hijacked session can expose pricing, order data, customer account details, approvals, and potentially privileged business workflows if the stolen token belongs to the wrong user.

1. Redact query strings everywhere — Strip or hash URL query parameters in reverse proxies, CDNs, WAF logs, APM traces, browser telemetry, and SIEM ingestion so the token cannot be harvested downstream. For a MEDIUM verdict there is no noisgate mitigation SLA; apply this in the next normal change window while you move toward remediation.
2. Expire and rotate sessions aggressively — Shorten session lifetime, invalidate tokens on logout, and force re-authentication for high-risk workflows so any leaked token dies faster. Again, there is no mitigation SLA for MEDIUM; use standard change control rather than emergency weekend work.
3. Tighten access to logs and support systems — Limit who can read raw request URLs in web logs, help-desk tickets, chat transcripts, and analytics tools because those systems become the easiest theft point. Do this during normal operational cleanup if those platforms currently retain full URLs.
4. Monitor for session replay anomalies — Alert on same-session use across unusual ASN changes, user-agent drift, impossible travel, or privileged actions immediately after a session appears in logging systems. This is a detective backstop, not a fix, but it meaningfully reduces dwell time until the patch is deployed.

Run this on a developer workstation, CI runner, or server that has access to the Configured Commerce codebase or deployment artifact. Invoke it as python3 verify_cve_2025_22387.py /path/to/repo-or-VersionInfo.yaml; it needs read-only access only and checks the declared Configured Commerce version against the fixed 5.2.2408 floor.

#!/usr/bin/env python3
# verify_cve_2025_22387.py
# Checks whether an Optimizely Configured Commerce deployment is below 5.2.2408.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE

import os
import re
import sys

FIX_MAJOR = 5
FIX_MINOR = 2
FIX_RELEASE = 2408


def norm_tuple(version_str):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', version_str)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_version(t):
    fixed = (FIX_MAJOR, FIX_MINOR, FIX_RELEASE)
    if t < fixed:
        return 'VULNERABLE'
    return 'PATCHED'


def find_versioninfo(start_path):
    if os.path.isfile(start_path):
        return start_path

    candidates = []
    for root, dirs, files in os.walk(start_path):
        if 'VersionInfo.yaml' in files:
            candidates.append(os.path.join(root, 'VersionInfo.yaml'))
        # keep walk bounded for safety on giant repos
        if root.count(os.sep) - start_path.count(os.sep) > 6:
            dirs[:] = []
    return candidates[0] if candidates else None


def extract_version(path):
    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
        data = f.read()

    # Try common patterns first.
    patterns = [
        r'(?im)^\s*version\s*:\s*["\']?([^"\'\n]+)',
        r'(?im)^\s*baseVersion\s*:\s*["\']?([^"\'\n]+)',
        r'(?im)^\s*releaseVersion\s*:\s*["\']?([^"\'\n]+)',
        r'(?im)^\s*commerceVersion\s*:\s*["\']?([^"\'\n]+)',
    ]
    for pat in patterns:
        m = re.search(pat, data)
        if m:
            return m.group(1).strip()

    # Fallback: first 5.2.x style version anywhere in file.
    m = re.search(r'(\d+\.\d+\.\d+(?:\.\d+)?(?:\+(?:sts|lts))?)', data, re.IGNORECASE)
    if m:
        return m.group(1).strip()

    return None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_cve_2025_22387.py /path/to/repo-or-VersionInfo.yaml')
        sys.exit(3)

    target = sys.argv[1]
    if not os.path.exists(target):
        print(f'UNKNOWN - path not found: {target}')
        sys.exit(2)

    vf = find_versioninfo(target)
    if not vf:
        print('UNKNOWN - could not locate VersionInfo.yaml under the supplied path')
        sys.exit(2)

    raw_version = extract_version(vf)
    if not raw_version:
        print(f'UNKNOWN - could not parse version from {vf}')
        sys.exit(2)

    parsed = norm_tuple(raw_version)
    if not parsed:
        print(f'UNKNOWN - unsupported version format: {raw_version}')
        sys.exit(2)

    result = compare_version(parsed)
    print(f'{result} - detected version {raw_version} from {vf}; fixed threshold is 5.2.2408')
    if result == 'VULNERABLE':
        sys.exit(1)
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Optimizely Configured Commerce Security Advisory COM-2024-06
2. NVD CVE-2025-22387
3. Optimizely Configured Commerce Security Announcements index
4. Optimizely Long-Term Support and Short-Term Support branches
5. Optimizely Configured Commerce release schedule
6. Optimizely Go-live with Configured Commerce
7. FIRST EPSS overview
8. CISA Known Exploited Vulnerabilities Catalog