GHSA-6mqr-q86q-6gwr

Source

https://github.com/advisories/GHSA-6mqr-q86q-6gwr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-6mqr-q86q-6gwr/GHSA-6mqr-q86q-6gwr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6mqr-q86q-6gwr

Published

2021-11-18T20:15:09Z

Modified

2023-05-26T15:07:57Z

Severity

9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Authentication Bypass by CSRF Weakness

Details

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

Executed whether as:
- A beforeaction callback (the default)
- A prependbeforeaction (option prepend: true given) before the :loadobject hook in Spree::UserController (most likely order to find).
Configured to use :nullsession or :resetsession strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.3 users should update to spreeauthdevise 4.4.1 Spree 4.2 users should update to spreeauthdevise 4.2.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rbto at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidusauthdevise/security/advisories/GHSA-xm34-v85h-9pg2

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-17T21:43:39Z"
}

GHSA-6mqr-q86q-6gwr

Impact

Patches

Workarounds

References

Affected packages

RubyGems / spree_auth_devise

Package

Affected ranges

Affected versions

4.*