PT-2021-23234 · Unknown · Solidus Auth Devise
Vampire000
·
Published
2021-11-17
·
Updated
2021-11-24
·
CVE-2021-41274
CVSS v3.1
9.3
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
solidus auth devise versions prior to 2.5.4
Description
The issue is a CSRF vulnerability that allows user account takeover. It affects applications using any version of the frontend component of
solidus auth devise if the protect from forgery method is executed as a before action callback or a prepend before action before the :load object hook in Spree::UserController, and is configured to use :null session or :reset session strategies.Recommendations
To resolve the issue, update to
solidus auth devise version 2.5.4.
If updating is not possible, change the strategy to :exception by adding protect from forgery with: :exception to the ApplicationController.
Alternatively, add config.after initialize do Spree::UsersController.protect from forgery with: :exception end to config/application.rb to run the :exception strategy on the affected controller.Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Solidus Auth Devise