PT-2020-16352 · Ruby On Rails · Spree

Damianlegawiec · Published 2020-11-13 · Updated 2020-11-30 · CVE-2020-26223

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spree versions prior to 3.7.11 Spree versions 3.7.11 through 3.7.12 are not affected, but versions prior to 3.7.11 are. However, considering the broader range, we can simplify to: Spree versions prior to 3.7.11 Spree versions 4.0.0 through 4.0.3 Spree versions 4.1.0 through 4.1.10

Description The issue concerns an authorization bypass vulnerability in Spree, a complete open source e-commerce solution built with Ruby on Rails. A perpetrator could query the "API v2 Order Status" endpoint with an empty string passed as an Order token.

Recommendations For Spree versions prior to 3.7.11, upgrade to version 3.7.11. For Spree versions 4.0.0 through 4.0.3, upgrade to version 4.0.4. For Spree versions 4.1.0 through 4.1.10, upgrade to version 4.1.11.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-26223

GHSA-M2JR-HMC3-QMPR

Affected Products

Spree

References · 10

• 🔥 https://github.com/spree/spree/pull/10573 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2020-26223.yml · Exploit
• https://osv.dev/vulnerability/CVE-2020-26223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26223 · Security Note
• https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2jr-hmc3-qmpr · Vendor Advisory
• https://github.com/spree/spree · Note
• https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr · Note
• https://rubygems.org/gems/spree_api/versions · Note
• https://t.me/cibsecurity/16316 · Telegram Post