cvelistv5 - cve-2024-40633

CVE-2024-40633 (GCVE-0-2024-40633)

Vulnerability from cvelistv5 – Published: 2024-07-17 17:51 – Updated: 2024-08-02 04:33

Title

Customer data leak via adjustments API endpoint in Sylius

Summary

Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information. The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

URL

Tags

https://github.com/Sylius/Sylius/security/advisor…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Sylius	Sylius	Affected: < 1.12.19 Affected: >= 1.13.0, < 1.13.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sylius",
            "vendor": "sylius",
            "versions": [
              {
                "lessThan": "1.12.19",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.13.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40633",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T19:06:37.163426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T19:17:09.615Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:33:11.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sylius",
          "vendor": "Sylius",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.12.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information.  The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-17T17:51:45.986Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43"
        }
      ],
      "source": {
        "advisory": "GHSA-55rf-8q29-4g43",
        "discovery": "UNKNOWN"
      },
      "title": "Customer data leak via adjustments API endpoint in Sylius"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-40633",
    "datePublished": "2024-07-17T17:51:45.986Z",
    "dateReserved": "2024-07-08T16:13:15.511Z",
    "dateUpdated": "2024-08-02T04:33:11.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information.  The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details.\"}, {\"lang\": \"es\", \"value\": \"Sylius es un framework de comercio electr\\u00f3nico de c\\u00f3digo abierto en Symfony. Se descubri\\u00f3 una vulnerabilidad de seguridad en el endpoint `/api/v2/shop/adjustments/{id}`, que recupera ajustes de pedidos basados en ID de enteros incrementales. La vulnerabilidad permite a un atacante enumerar ID de ajuste v\\u00e1lidos y recuperar tokens de pedido. Al utilizar estos tokens, un atacante puede acceder a los detalles del pedido de los clientes invitados: informaci\\u00f3n confidencial del cliente invitado. El problema se solucion\\u00f3 en las versiones: 1.12.19, 1.13.4 y superiores. `/api/v2/shop/adjustments/{id}` siempre devolver\\u00e1 el estado `404`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden modificar su configuraci\\u00f3n para mitigar este problema. Consulte la GHSA vinculada para obtener m\\u00e1s detalles.\"}]",
      "id": "CVE-2024-40633",
      "lastModified": "2024-11-21T09:31:24.107",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-07-17T18:15:04.107",
      "references": "[{\"url\": \"https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40633\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-07-17T18:15:04.107\",\"lastModified\":\"2024-11-21T09:31:24.107\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information.  The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details.\"},{\"lang\":\"es\",\"value\":\"Sylius es un framework de comercio electr\u00f3nico de c\u00f3digo abierto en Symfony. Se descubri\u00f3 una vulnerabilidad de seguridad en el endpoint `/api/v2/shop/adjustments/{id}`, que recupera ajustes de pedidos basados en ID de enteros incrementales. La vulnerabilidad permite a un atacante enumerar ID de ajuste v\u00e1lidos y recuperar tokens de pedido. Al utilizar estos tokens, un atacante puede acceder a los detalles del pedido de los clientes invitados: informaci\u00f3n confidencial del cliente invitado. El problema se solucion\u00f3 en las versiones: 1.12.19, 1.13.4 y superiores. `/api/v2/shop/adjustments/{id}` siempre devolver\u00e1 el estado `404`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden modificar su configuraci\u00f3n para mitigar este problema. Consulte la GHSA vinculada para obtener m\u00e1s detalles.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40633\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-17T19:06:37.163426Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*\"], \"vendor\": \"sylius\", \"product\": \"sylius\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.12.19\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.13.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-17T19:17:03.787Z\"}}], \"cna\": {\"title\": \"Customer data leak via adjustments API endpoint in Sylius\", \"source\": {\"advisory\": \"GHSA-55rf-8q29-4g43\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Sylius\", \"product\": \"Sylius\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.12.19\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.13.0, \u003c 1.13.4\"}]}], \"references\": [{\"url\": \"https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43\", \"name\": \"https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information.  The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-17T17:51:45.986Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40633\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-17T19:17:09.615Z\", \"dateReserved\": \"2024-07-08T16:13:15.511Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-17T17:51:45.986Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-40633

Vulnerability from fkie_nvd - Published: 2024-07-17 18:15 - Updated: 2024-11-21 09:31

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information.  The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details."
    },
    {
      "lang": "es",
      "value": "Sylius es un framework de comercio electr\u00f3nico de c\u00f3digo abierto en Symfony. Se descubri\u00f3 una vulnerabilidad de seguridad en el endpoint `/api/v2/shop/adjustments/{id}`, que recupera ajustes de pedidos basados en ID de enteros incrementales. La vulnerabilidad permite a un atacante enumerar ID de ajuste v\u00e1lidos y recuperar tokens de pedido. Al utilizar estos tokens, un atacante puede acceder a los detalles del pedido de los clientes invitados: informaci\u00f3n confidencial del cliente invitado. El problema se solucion\u00f3 en las versiones: 1.12.19, 1.13.4 y superiores. `/api/v2/shop/adjustments/{id}` siempre devolver\u00e1 el estado `404`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden modificar su configuraci\u00f3n para mitigar este problema. Consulte la GHSA vinculada para obtener m\u00e1s detalles."
    }
  ],
  "id": "CVE-2024-40633",
  "lastModified": "2024-11-21T09:31:24.107",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-07-17T18:15:04.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-55RF-8Q29-4G43

Vulnerability from github – Published: 2024-07-17 14:32 – Updated: 2024-07-17 19:13

Summary

Sylius has a security vulnerability via adjustments API endpoint

Details

Impact

A security vulnerability was discovered in the /api/v2/shop/adjustments/{id} endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information.

Patches

The issue is fixed in versions: 1.12.19, 1.13.4 and above. The /api/v2/shop/adjustments/{id} will always return 404 status.

Workarounds

Using YAML configuration:

Create config/api_platform/Adjustment.yaml file:

# config/api_platform/Adjustment.yaml

'%sylius.model.adjustment.class%':
    itemOperations:
        shop_get:
            controller: ApiPlatform\Core\Action\NotFoundAction
            read: false
            output: false

Or using XML configuration:

Copy the original configuration from vendor:

cp vendor/sylius/sylius/src/Sylius/Bundle/ApiBundle/Resources/config/api_resources/Adjustment.xml config/api_platform

And change the shop_get operation in copied config/api_platform/Adjustment.xml file:

<!-- config/api_platform/Adjustment.xml -->

...
<itemOperation name="shop_get">
    <attribute name="method">GET</attribute>
    <attribute name="path">/shop/adjustments/{id}</attribute>
    <attribute name="controller">ApiPlatform\Core\Action\NotFoundAction</attribute>
    <attribute name="read">false</attribute>
    <attribute name="output">false</attribute>
</itemOperation>
...

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.13.0-alpha.1"
            },
            {
              "fixed": "1.13.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-40633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-17T14:32:18Z",
    "nvd_published_at": "2024-07-17T18:15:04Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nA security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information. \n\n### Patches\nThe issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status.\n\n### Workarounds\n\nUsing YAML configuration:\n\nCreate `config/api_platform/Adjustment.yaml` file:\n\n```yaml\n# config/api_platform/Adjustment.yaml\n\n\u0027%sylius.model.adjustment.class%\u0027:\n    itemOperations:\n        shop_get:\n            controller: ApiPlatform\\Core\\Action\\NotFoundAction\n            read: false\n            output: false\n```\n\nOr using XML configuration:\n\nCopy the original configuration from vendor:\n\n```bash\ncp vendor/sylius/sylius/src/Sylius/Bundle/ApiBundle/Resources/config/api_resources/Adjustment.xml config/api_platform\n```\n\nAnd change the `shop_get` operation in copied `config/api_platform/Adjustment.xml` file:\n\n```xml\n\u003c!-- config/api_platform/Adjustment.xml --\u003e\n\n...\n\u003citemOperation name=\"shop_get\"\u003e\n    \u003cattribute name=\"method\"\u003eGET\u003c/attribute\u003e\n    \u003cattribute name=\"path\"\u003e/shop/adjustments/{id}\u003c/attribute\u003e\n    \u003cattribute name=\"controller\"\u003eApiPlatform\\Core\\Action\\NotFoundAction\u003c/attribute\u003e\n    \u003cattribute name=\"read\"\u003efalse\u003c/attribute\u003e\n    \u003cattribute name=\"output\"\u003efalse\u003c/attribute\u003e\n\u003c/itemOperation\u003e\n...\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)\n- Email us at [security@sylius.com](mailto:security@sylius.com)\n",
  "id": "GHSA-55rf-8q29-4g43",
  "modified": "2024-07-17T19:13:34Z",
  "published": "2024-07-17T14:32:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/Sylius/commit/d833b2871caa3b8d1f0a8207378bb778f0b90464"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sylius/Sylius"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Sylius has a security vulnerability via adjustments API endpoint"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-40633 (GCVE-0-2024-40633)

FKIE_CVE-2024-40633

GHSA-55RF-8Q29-4G43

Impact

Patches

Workarounds

For more information

Tags

Sightings

Nomenclature