Shop customers see other customers' “My account” page: name, address, orders

The MasterLinux shop (boutique.masterlinux.lab) sells the training packs. It is served by the CloudFront distribution E1MLX7Q2B9K4TZ in front of an ALB and the origin server ml-web-01 (nginx + Node.js application). The customer account pages are under /compte/*, the session is in the ml_session cookie.

Yesterday at 18:12, the platform team released change CHG-2231 “CloudFront cache optimisation, lower load on the origin”. Since this morning, support has received eleven reports: when opening “My account”, students see another student's name, address and order history.

This is a personal data leak in progress. The CTO wants it to stop within the hour, without taking the shop down, and a report for the notification. You are the on-call cloud security engineer, on ml-poste-01 (AWS CLI v2, curl), with SSH access to ml-web-01. Support has given you two session cookies of test accounts: ml_session=t3st-a71 (etudiant-test-a) and ml_session=t3st-b52 (etudiant-test-b).