Low, CVSS 2.3RubyGemsPublished
CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend
CVE-2022-31000 · GHSA-8639-qx56-r428
- Affected
- RubyGems solidus_backend < 2.11.16; >= 3.0.0, < 3.0.6; >= 3.1.0, < 3.1.6
- Fixed in
- 2.11.163.0.63.1.6· Vendor fix available
- Issue
- Impact CSRF vulnerability allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Reproduction steps: - Take an order's number. - Log in as an administrator. - Visit that order's adjustments section (Orders - {Click on number} - Adjustments) and check that its adjustments are finalized (closed padlock under the State column). - On another tab, visit {yoursiteurl}/admin/orders/{ordernumber}/adjustments/unfinalize. - Notice how the adjustments are unfinalized (open padlock), even if the previous was a GET request which could have been linked from any other site. - Visit {yoursiteurl}/admin/orders/{ordernumber}/adjustments/finalize. - Notice how the adjustments are again finalized. That happened because both routes were handled as GET requests, which are skipped by Rails anti-forgery protection. Patches Users should upgrade to solidusbackend v3.1.6, v3.0.6, or v2.11.16, depending on the…
Recommended action: Upgrade to 3.1.6, 3.0.6 or 2.11.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.