GSD-2020-15109

Vulnerability from gsd - Updated: 2020-08-04 00:00
Details
### Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. E.g. 1. Store admin configured the store so that there are two zones in US: * East Cost Zone - Shipping Method cost: $1 * West Cost Zone - Shipping Method cost: $10 The attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout. 2. The attacker user enters any NY shipping address in the address step 3. The attacker user chooses the $1 delivery option 4. The attacker user crafts a request with their real LA address, similar to: ``` // POST #checkout/update: { state: 'payment', order: { ship_address_attributes: { city: 'Los Angeles', ... } } } ``` 5. The attacker user proceeds with checking out with a new address and the $1 shipment costs. Another scenario where this could be dangerous is: > You cannot ship products in some zones and you are relying on Solidus > Shipping Method building only to filter out unwanted zones. Malicious > users can enter an allowed zone's address and change back to an unwanted > one in the payment step by crafting a request with some proper > ship_address_attributes. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. ### Workarounds When it's not possible to upgrade to a supported patched version, please use this gist to patch the store: https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d
Aliases
Aliases
CVE-2020-15109
To clipboard 

{
  "GSD": {
    "alias": "CVE-2020-15109",
    "description": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.",
    "id": "GSD-2020-15109"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "solidus_api",
            "purl": "pkg:gem/solidus_api"
          }
        }
      ],
      "aliases": [
        "CVE-2020-15109",
        "GHSA-3mvg-rrrw-m7ph"
      ],
      "details": "### Impact\nThis vulnerability allows a malicious customer to craft request data with\nparameters that allow changing the address of the current order without\nchanging the shipment costs associated with the new shipment.\n\nAll stores with at least two shipping zones and different costs of shipment\nper zone are impacted.\n\nE.g.\n\n1. Store admin configured the store so that there are two zones in US:\n   * East Cost Zone - Shipping Method cost: $1\n   * West Cost Zone - Shipping Method cost: $10\n\nThe attacker user can know that shipping to NY is less expensive than to LA\njust by testing different addresses in checkout.\n\n2. The attacker user enters any NY shipping address in the address step\n3. The attacker user chooses the $1 delivery option\n4. The attacker user crafts a request with their real LA address, similar to:\n\n```\n// POST #checkout/update:\n\n{\n  state: \u0027payment\u0027,\n  order: {\n    ship_address_attributes: {\n      city: \u0027Los Angeles\u0027,\n      ...\n    }\n  }\n}\n```\n\n5. The attacker user proceeds with checking out with a new address and the $1\nshipment costs.\n\nAnother scenario where this could be dangerous is:\n\n\u003e You cannot ship products in some zones and you are relying on Solidus\n\u003e Shipping Method building only to filter out unwanted zones. Malicious\n\u003e users can enter an allowed zone\u0027s address and change back to an unwanted\n\u003e one in the payment step by crafting a request with some proper\n\u003e ship_address_attributes.\n\nThis problem comes from how checkout permitted attributes are structured.\nWe have a single list of attributes that are permitted across the whole\ncheckout, no matter the step that is being submitted.\n\n### Workarounds\nWhen it\u0027s not possible to upgrade to a supported patched version, please\nuse this gist to patch the store:\n\nhttps://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d\n",
      "id": "GSD-2020-15109",
      "modified": "2020-08-04T00:00:00.000Z",
      "published": "2020-08-04T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 5.3,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Ability to change order address without triggering address validations in solidus"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-15109",
        "STATE": "PUBLIC",
        "TITLE": "Ability to change order address without triggering address validations in solidus"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "solidus",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 2.8.6"
                        },
                        {
                          "version_value": "\u003e= 2.9.0, \u003c 2.9.6"
                        },
                        {
                          "version_value": "\u003e= 2.10.0, \u003c 2.10.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "solidusio"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-20: Improper Input Validation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph",
            "refsource": "CONFIRM",
            "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
          },
          {
            "name": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d",
            "refsource": "MISC",
            "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-3mvg-rrrw-m7ph",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2020-15109",
      "cvss_v3": 5.3,
      "date": "2020-08-04",
      "description": "### Impact\nThis vulnerability allows a malicious customer to craft request data with\nparameters that allow changing the address of the current order without\nchanging the shipment costs associated with the new shipment.\n\nAll stores with at least two shipping zones and different costs of shipment\nper zone are impacted.\n\nE.g.\n\n1. Store admin configured the store so that there are two zones in US:\n   * East Cost Zone - Shipping Method cost: $1\n   * West Cost Zone - Shipping Method cost: $10\n\nThe attacker user can know that shipping to NY is less expensive than to LA\njust by testing different addresses in checkout.\n\n2. The attacker user enters any NY shipping address in the address step\n3. The attacker user chooses the $1 delivery option\n4. The attacker user crafts a request with their real LA address, similar to:\n\n```\n// POST #checkout/update:\n\n{\n  state: \u0027payment\u0027,\n  order: {\n    ship_address_attributes: {\n      city: \u0027Los Angeles\u0027,\n      ...\n    }\n  }\n}\n```\n\n5. The attacker user proceeds with checking out with a new address and the $1\nshipment costs.\n\nAnother scenario where this could be dangerous is:\n\n\u003e You cannot ship products in some zones and you are relying on Solidus\n\u003e Shipping Method building only to filter out unwanted zones. Malicious\n\u003e users can enter an allowed zone\u0027s address and change back to an unwanted\n\u003e one in the payment step by crafting a request with some proper\n\u003e ship_address_attributes.\n\nThis problem comes from how checkout permitted attributes are structured.\nWe have a single list of attributes that are permitted across the whole\ncheckout, no matter the step that is being submitted.\n\n### Workarounds\nWhen it\u0027s not possible to upgrade to a supported patched version, please\nuse this gist to patch the store:\n\nhttps://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d\n",
      "gem": "solidus_frontend",
      "ghsa": "3mvg-rrrw-m7ph",
      "patched_versions": [
        "~\u003e 2.8.6",
        "~\u003e 2.9.6",
        "\u003e= 2.10.2"
      ],
      "title": "Ability to change order address without triggering address validations in solidus",
      "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.8.6||\u003e=2.9.0 \u003c2.9.6||\u003e=2.10.0 \u003c2.10.2",
          "affected_versions": "All versions before 2.8.6, all versions starting from 2.9.0 before 2.9.6, all versions starting from 2.10.0 before 2.10.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-862",
            "CWE-937"
          ],
          "date": "2021-11-18",
          "description": "This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted.",
          "fixed_versions": [
            "2.8.6",
            "2.9.6",
            "2.10.2"
          ],
          "identifier": "CVE-2020-15109",
          "identifiers": [
            "CVE-2020-15109",
            "GHSA-3mvg-rrrw-m7ph"
          ],
          "not_impacted": "All versions starting from 2.8.6 before 2.9.0, all versions starting from 2.9.6 before 2.10.0, all versions starting from 2.10.2",
          "package_slug": "gem/solidus",
          "pubdate": "2020-08-04",
          "solution": "Upgrade to versions 2.8.6, 2.9.6, 2.10.2 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15109"
          ],
          "uuid": "6a8cfea7-1cf9-4670-810d-c91f2f22692b"
        },
        {
          "affected_range": "\u003c2.8.6||\u003e=2.9.0 \u003c2.9.6||\u003e=2.10.0 \u003c2.10.2",
          "affected_versions": "All versions before 2.8.6, all versions starting from 2.9.0 before 2.9.6, all versions starting from 2.10.0 before 2.10.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-862",
            "CWE-937"
          ],
          "date": "2021-11-18",
          "description": "This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted.",
          "fixed_versions": [
            "2.8.6",
            "2.9.6",
            "2.10.2"
          ],
          "identifier": "CVE-2020-15109",
          "identifiers": [
            "CVE-2020-15109",
            "GHSA-3mvg-rrrw-m7ph"
          ],
          "not_impacted": "All versions starting from 2.8.6 before 2.9.0, all versions starting from 2.9.6 before 2.10.0, all versions starting from 2.10.2",
          "package_slug": "gem/solidus_api",
          "pubdate": "2020-08-04",
          "solution": "Upgrade to versions 2.8.6, 2.9.6, 2.10.2 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15109"
          ],
          "uuid": "bf0db89f-f536-4a6f-91e8-5a92fdd0af28"
        },
        {
          "affected_range": "\u003c2.8.6||\u003e=2.9.0 \u003c2.9.6||\u003e=2.10.0 \u003c2.10.2",
          "affected_versions": "All versions before 2.8.6, all versions starting from 2.9.0 before 2.9.6, all versions starting from 2.10.0 before 2.10.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-862",
            "CWE-937"
          ],
          "date": "2021-11-18",
          "description": "This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.",
          "fixed_versions": [
            "2.8.6",
            "2.9.6",
            "2.10.2"
          ],
          "identifier": "CVE-2020-15109",
          "identifiers": [
            "CVE-2020-15109",
            "GHSA-3mvg-rrrw-m7ph"
          ],
          "not_impacted": "All versions starting from 2.8.6 before 2.9.0, all versions starting from 2.9.6 before 2.10.0, all versions starting from 2.10.2",
          "package_slug": "gem/solidus_core",
          "pubdate": "2020-08-04",
          "solution": "Upgrade to versions 2.8.6, 2.9.6, 2.10.2 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15109",
            "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"
          ],
          "uuid": "edee36f4-bfcd-4c22-9418-9213caf9e45c"
        },
        {
          "affected_range": "\u003c2.8.6||\u003e=2.9.0 \u003c2.9.6||\u003e=2.10.0 \u003c2.10.2",
          "affected_versions": "All versions before 2.8.6, all versions starting from 2.9.0 before 2.9.6, all versions starting from 2.10.0 before 2.10.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2020-08-10",
          "description": "In solidus, there is an ability to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.",
          "fixed_versions": [
            "2.8.6",
            "2.9.6",
            "2.10.2"
          ],
          "identifier": "CVE-2020-15109",
          "identifiers": [
            "CVE-2020-15109",
            "GHSA-3mvg-rrrw-m7ph"
          ],
          "not_impacted": "All versions starting from 2.8.6 before 2.9.0, all versions starting from 2.9.6 before 2.10.0, all versions starting from 2.10.2",
          "package_slug": "gem/solidus_frontend",
          "pubdate": "2020-08-04",
          "solution": "Upgrade to versions 2.8.6, 2.9.6, 2.10.2 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15109",
            "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d",
            "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
          ],
          "uuid": "97730a37-37c4-422e-9e2f-8e995f3ac04e"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.8.6",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.9.6",
                "versionStartIncluding": "2.9.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.10.2",
                "versionStartIncluding": "2.10.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15109"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"
            },
            {
              "name": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2021-11-18T18:29Z",
      "publishedDate": "2020-08-04T23:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.