GHSA-3MVG-RRRW-M7PH

Vulnerability from github – Published: 2020-08-04 22:17 – Updated: 2021-11-19 15:41
VLAI?
Summary
Ability to change order address without triggering address validations in solidus
Details

Impact

This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment.

All stores with at least two shipping zones and different costs of shipment per zone are impacted.

E.g. 1. Store admin configured the store so that there are two zones in US: - East Cost Zone - Shipping Method cost: $1 - West Cost Zone - Shipping Method cost: $10

The attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout.

  1. The attacker user enters any NY shipping address in the address step
  2. The attacker user chooses the $1 delivery option
  3. The attacker user crafts a request with their real LA address, similar to:
// POST #checkout/update:

{
  state: 'payment',
  order: {
    ship_address_attributes: {
      city: 'Los Angeles',
      ...
    }
  }
}
  1. The attacker user proceeds with checking out with a new address and the $1 shipment costs.

Another scenario where this could be dangerous is:

You cannot ship products in some zones and you are relying on Solidus Shipping Method building only to filter out unwanted zones. Malicious users can enter an allowed zone's address and change back to an unwanted one in the payment step by crafting a request with some proper ship_address_attributes.

This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted.

Patches

A PR has been attached to fix the security concern for each of all the Solidus supported versions following the rules of the Solidus Security Policy.

Workarounds

When it's not possible to upgrade to a supported patched version, please use this gist to patch the store:

https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d

Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "solidus_frontend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "solidus_frontend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.9.0"
            },
            {
              "fixed": "2.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "solidus_frontend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "solidus_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "solidus_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.9.0"
            },
            {
              "fixed": "2.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "solidus_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15109"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-04T20:54:07Z",
    "nvd_published_at": "2020-08-04T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThis vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment.\n\nAll stores with at least two shipping zones and different costs of shipment per zone are impacted. \n\nE.g.\n1. Store admin configured the store so that there are two zones in US:\n-  East Cost Zone - Shipping Method cost: $1\n- West Cost Zone - Shipping Method cost: $10\n\nThe attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout.\n\n2. The attacker user enters any NY shipping address in the address step\n3. The attacker user chooses the $1 delivery option\n4. The attacker user crafts a request with their real LA address, similar to:\n\n```\n// POST #checkout/update:\n\n{\n  state: \u0027payment\u0027,\n  order: {\n    ship_address_attributes: {\n      city: \u0027Los Angeles\u0027,\n      ...\n    }\n  }\n}\n```\n5. The attacker user proceeds with checking out with a new address and the $1 shipment costs.\n\nAnother scenario where this could be dangerous is:\n\n\u003e You cannot ship products in some zones and you are relying on Solidus Shipping Method building only to filter out unwanted zones. Malicious users can enter an allowed zone\u0027s address and change back to an unwanted one in the payment step by crafting a request with some proper ship_address_attributes.\n\nThis problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted.\n\n### Patches\n\nA PR has been attached to fix the security concern for each of all the Solidus supported versions following the rules of the [Solidus Security Policy](https://solidus.io/security).\n\n### Workarounds\n\nWhen it\u0027s not possible to upgrade to a supported patched version, please use this gist to patch the store:\n\nhttps://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d",
  "id": "GHSA-3mvg-rrrw-m7ph",
  "modified": "2021-11-19T15:41:33Z",
  "published": "2020-08-04T22:17:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15109"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_api/CVE-2020-15109.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2020-15109.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/solidusio/solidus"
    },
    {
      "type": "WEB",
      "url": "https://solidus.io/blog/2020/07/16/new-releases.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ability to change order address without triggering address validations in solidus"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.