GHSA-8xfw-5q82-3652

Source
https://github.com/advisories/GHSA-8xfw-5q82-3652
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-8xfw-5q82-3652/GHSA-8xfw-5q82-3652.json
Published
2021-11-18T20:15:23Z
Modified
2023-05-26T15:07:05Z
Details

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both:

  • Executed whether as:
    • A beforeaction callback (the default)
    • A prependbeforeaction (option prepend: true given) before the :loadobject hook in Spree::UserController (most likely order to find).
  • Configured to use :nullsession or :resetsession strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏

Patches

Spree 4.1 users should update to spreeauthdevise 4.1.1

Workarounds

If possible, change your strategy to :exception:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Add the following toconfig/application.rbto at least run the :exception strategy on the affected controller:

config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end

References

https://github.com/solidusio/solidusauthdevise/security/advisories/GHSA-xm34-v85h-9pg2

References

Affected packages

RubyGems / spree_auth_devise

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
4.1.1

Affected versions

4.*

4.1.0