GHSA-8639-qx56-r428

    Dashboard / Vulnerabilities / GHSA-8639-qx56-r428

    GHSA-8639-qx56-r428

    Published: 1 Jun 2022Last Modified: 8 Nov 2023

    Summary: CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

    Details: ### Impact CSRF vulnerability allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Reproduction steps: - Take an order's number. - Log in as an administrator. - Visit that order's adjustments section (_Orders -> {Click on number} -> Adjustments_) and check that its adjustments are finalized (closed padlock under the **State** column). - On another tab, visit `{your_site_url}/admin/orders/{order_number}/adjustments/unfinalize`. - Notice how the adjustments are unfinalized (open padlock), even if the previous was a `GET` request which could have been linked from any other site. - Visit `{your_site_url}/admin/orders/{order_number}/adjustments/finalize`. - Notice how the adjustments are again finalized. That happened because both routes were handled as `GET` requests, which are skipped by Rails anti-forgery protection. ### Patches Users should upgrade to solidus_backend v3.1.6, v3.0.6, or v2.11.16, depending on the major and minor versions in use. ### References - [Rails CSRF protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html). ### For more information If you have any questions or comments about this advisory: - Open an [issue](https://github.com/solidusio/solidus/issues) or a [discussion](https://github.com/solidusio/solidus/discussions) in Solidus. - Email us at [[email protected]](mailto:[email protected]) - Contact the core team on [Slack](http://slack.solidus.io/)

    References: https://github.com/solidusio/solidus/security/advisories/GHSA-8639-qx56-r428, https://nvd.nist.gov/vuln/detail/CVE-2022-31000, https://github.com/solidusio/solidus/commit/de796a2e0be7f154cae48b46e267501559d9716c, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_backend/CVE-2022-31000.yml, https://github.com/solidusio/solidus

    Affected packages

    Package

    Name: solidus_backend

    Purl: pkg:gem/solidus_backend

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.11.16

    Affected versions

    1.0.0
    1.0.0.pre
    1.0.0.pre2
    1.0.0.pre3
    1.0.0.rc1
    1.0.0.rc2
    1.0.1
    1.0.2
    1.0.3
    1.0.4
    1.0.5
    1.0.6
    1.0.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-8639-qx56-r428 | CVE-DB