PT-2013-3299 · Spree · Spree Commerce

Publicado 2013-03-08 · Atualizado 2020-12-04 · CVE-2013-1656

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Spree Commerce versions 1.0.x through 1.3.2 Spree Commerce versions 1.0.x before 2.0.0.rc1

Description The issue allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands. This is related to the unsafe use of the constantize function in several parameters, including payment method to core/app/controllers/spree/admin/payment methods controller.rb, promotion action parameter to promotion actions controller.rb, promotion rule parameter to promotion rules controller.rb, and calculator type parameter to promotions controller.rb in promo/app/controllers/spree/admin/.

Recommendations For Spree Commerce versions 1.0.x through 1.3.2, consider disabling the vulnerable parameters payment method, promotion action, promotion rule, and calculator type until a patch is available. For Spree Commerce versions 1.0.x before 2.0.0.rc1, consider disabling the vulnerable parameters payment method, promotion action, promotion rule, and calculator type until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-1656

GHSA-JXX8-V83V-RHW3

Produtos afetados

Spree Commerce

Referências · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.yml · Exploit
• 🔥 https://conviso.com.br/advisories/CVE-2013-1656.txt · Exploit
• https://github.com/spree/spree · Nota
• https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7 · Nota
• https://web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed · Nota
• https://web.archive.org/web/20130907044454/https://conviso.com.br/advisories/CVE-2013-1656.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1656 · Nota de Segurança
• https://blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656 · Nota
• https://web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html · Nota
• https://osv.dev/vulnerability/GHSA-jxx8-v83v-rhw3 · Aviso do Fabricante
• http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html · Nota
• http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed · Aviso do Fabricante