The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
This was a 2014 security report about two separate AliExpress flaws: cross-site scripting in buyer-to-supplier messages that put seller sessions at risk, and an authorization weakness that exposed buyers’ order shipping details. Alibaba said it closed both potential vulnerabilities at the time; the available reporting does not independently validate the fixes or establish AliExpress’s current security status.
What happened on AliExpress
On December 11, 2014, SecurityWeek reported that researchers had identified two weaknesses on AliExpress, Alibaba’s online marketplace. The flaws affected different features and different groups of users; they were not one attack or one kind of data exposure. SecurityWeek’s report described a message-form vulnerability that could put suppliers’ accounts at risk and a separate order-detail flaw that exposed buyers’ shipping information.
The report cited 7.7 million AliExpress users in more than 200 countries and regions, a figure reported as of July 2013. That is historical context, not a current user count.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How the two vulnerabilities differed
| Vulnerability | Where it occurred | Who was at risk | Reported potential impact |
|---|---|---|---|
| Cross-site scripting (XSS) | Buyer-to-supplier message form | Suppliers opening a malicious message | Code could run in a supplier’s browser, potentially enabling phishing, session-ID theft, actions on the supplier’s behalf, or a store takeover. |
| Insecure direct object reference (IDOR) | Order shipping-detail URL handling | Buyers whose order details were accessible through a changed URL parameter | A name, address, and contact information could be exposed. |
Message-form XSS put seller sessions at risk
Security researcher Barak Tawily of AppSec Labs found that malicious code could be inserted through the buyer-to-supplier message form and run in a supplier’s browser when the message was opened. If successful, the described consequences included stealing a seller’s session ID and using the session to act as that seller. The report discussed possible store takeover, but did not establish that any account was actually hijacked.
#1 Best Overall
Order-detail IDOR exposed buyer shipping information
Security researcher Amitay Dan of Cybermoon found a separate issue: changing a URL parameter could expose a buyer’s order shipping details, including name, address, and contact information. This was an object-authorization problem affecting buyer privacy, not the seller-session attack. SecurityWeek did not report exposure of credit-card details.
What is known about the response
Alibaba told SecurityWeek by email that it took immediate steps to assess and remedy the situation and had closed the “potential vulnerabilities.” The company also said, “The security and privacy of our customers is our highest priority.” The report does not name an individual spokesperson. This is Alibaba’s contemporaneous account of its response; the available sources do not independently verify the remediation.
The report does not establish confirmed exploitation, how many accounts may have been affected, or whether the flaws are exploitable today. It describes a historical incident, not a newly announced breach.
What account holders can do about account theft generally
Alibaba.com’s general account-stolen guidance identifies phishing or spoof messages, reused passwords, and malware as common routes to account theft. Its recommendations address general account security; they do not fix or verify a repair to the AliExpress application flaws described above.
- Avoid logging in through suspicious links or messages; navigate to the marketplace directly instead.
- Use distinct passwords for the marketplace and registered email account.
- If compromise is suspected, run an antivirus check, change both passwords, and review listings, inquiries, and account settings for changes you did not make.
How to report a vulnerability to Alibaba
Alibaba Security Response Center’s vulnerability-reporting page asks researchers to provide a description, proof, and proposed remediation, and requests that unremediated issues not be disclosed publicly. A June 6, 2024 notice says subsequent vulnerability submissions should go to Xianzhi. Because reporting routes can change, researchers should confirm the current submission route on Alibaba’s official pages before sending a report: ASRC-to-Xianzhi migration notice.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
