Medium, CVSS 5.3RubyGemsPublished
Ability to change order address without triggering address validations in solidus
CVE-2020-15109 · GHSA-3mvg-rrrw-m7ph
- Affected
- RubyGems solidus_api < 2.8.6; >= 2.9.0, < 2.9.6; >= 2.10.0, < 2.10.2
- Fixed in
- 2.8.62.10.22.9.6· Vendor fix available
- Issue
- Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. E.g. 1. Store admin configured the store so that there are two zones in US: - East Cost Zone - Shipping Method cost: $1 - West Cost Zone - Shipping Method cost: $10 The attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout. 2. The attacker user enters any NY shipping address in the address step 3. The attacker user chooses the $1 delivery option 4. The attacker user crafts a request with their real LA address, similar to: 5. The attacker user proceeds with checking out with a new address and the $1 shipment costs. Another scenario where this could be dangerous is: You cannot ship products in some zones and you…
Recommended action: Upgrade to 2.10.2, 2.9.6 or 2.8.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.