PT-2013-3299 · Spree · Spree Commerce

Published 2013-03-08 · Updated 2020-12-04 · CVE-2013-1656

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Spree Commerce versions 1.0.x through 1.3.2 Spree Commerce versions 1.0.x before 2.0.0.rc1

Description The issue allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands. This is related to the unsafe use of the constantize function in several parameters, including payment method to core/app/controllers/spree/admin/payment methods controller.rb, promotion action parameter to promotion actions controller.rb, promotion rule parameter to promotion rules controller.rb, and calculator type parameter to promotions controller.rb in promo/app/controllers/spree/admin/.

Recommendations For Spree Commerce versions 1.0.x through 1.3.2, consider disabling the vulnerable parameters payment method, promotion action, promotion rule, and calculator type until a patch is available. For Spree Commerce versions 1.0.x before 2.0.0.rc1, consider disabling the vulnerable parameters payment method, promotion action, promotion rule, and calculator type until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1656

GHSA-JXX8-V83V-RHW3

Affected Products

Spree Commerce

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.yml · Exploit
• 🔥 https://conviso.com.br/advisories/CVE-2013-1656.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1656 · Security Note
• https://osv.dev/vulnerability/GHSA-jxx8-v83v-rhw3 · Vendor Advisory
• http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed · Vendor Advisory
• https://github.com/spree/spree · Note
• https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7 · Note
• https://web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed · Note
• https://web.archive.org/web/20130907044454/https://conviso.com.br/advisories/CVE-2013-1656.txt · Note
• https://blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656 · Note
• https://web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html · Note
• http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html · Note