spree 0.70.0.rc2

8 security vulnerabilities found in version 0.70.0.rc2

Potential XSS vulnerability related to the analytics dashboard

high severity OSVDB-125713
high severity OSVDB-125713
Patched versions: ~> 0.11.4, ~> 0.70.6, ~> 1.0.5, >= 1.1.2

Spree has a flaw in its analytics dashboard where keywords are not escaped, leading to potential XSS.

Product Scopes could allow for unauthenticated remote command execution

high severity OSVDB-125712
high severity OSVDB-125712
Patched versions: ~> 0.11.4, ~> 0.70.6, ~> 1.0.5, >= 1.1.2

Product Scopes could allow for unauthenticated remote command execution. This was corrected by removing conditions_any scope and use ARel query building instead.

Spree RABL templates rendering allows Arbitrary Code Execution and File Disclosure

high severity OSVDB-125701
high severity OSVDB-125701
Patched versions: ~> 2.2.12, ~> 2.3.11, ~> 2.4.8, >= 3.0.2

Spree contains a flaw where the rendering of arbitrary RABL templates allows for execution arbitrary files on the host system, as well as disclosing the existence of files on the system.

Spree RABL templates rendering allows Arbitrary Code Execution and File Disclosure

high severity OSVDB-125699
high severity OSVDB-125699
Patched versions: ~> 2.2.13, ~> 2.3.12, ~> 2.4.9, >= 3.0.3

Spree contains a flaw where the rendering of arbitrary RABL templates allows for execution arbitrary files on the host system, as well as disclosing the existence of files on the system. This is a different issue than OSVDB-125701.

Spree API Information Disclosure CSRF

high severity OSVDB-119205
high severity OSVDB-119205
Patched versions: ~> 2.2.10, ~> 2.3.8, ~> 2.4.5, >= 3.0.0.rc4

Spree contains a flaw in the API as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to disclose potentially sensitive information to attackers.

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

high severity CVE-2020-15269
high severity CVE-2020-15269
Affected versions: < 3.7.11

Impact

The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints.

Patches

Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.

Workarounds

In your project directory create a decorator file app/controllers/spree/api/v2/base_controller_decotatror.rb with contents:

module Spree
  module Api
    module V2
      module BaseControllerDecorator
        private

        def spree_current_user
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
        end
     end
  end
end

Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)

For more information

If you have any questions or comments about this advisory:

Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation

medium severity CVE-2013-2506
medium severity CVE-2013-2506
Patched versions: ~> 1.1.6, ~> 1.2.0, >= 1.3.0

Spree contains a flaw that leads to unauthorized privileges being gained. The issue is triggered as certain input related to mass role assignment in app/models/spree/user.rb is not properly verified before being used to update a user. This may allow a remote attacker to assign arbitrary roles and gain elevated administrative privileges.

Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution

medium severity CVE-2013-1656
medium severity CVE-2013-1656
Patched versions: >= 2.0.0

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and executd arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/ payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

Gem version without a license.


Unless a license that specifies otherwise is included, nobody can use, copy, distribute, or modify this library without being at risk of take-downs, shake-downs, or litigation.

This gem version is available.


This gem version has not been yanked and is still available for usage.