PT-2024-40115 · Sylius · Sylius

Published 2024-05-29 · Updated 2024-05-29

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Sylius versions 1.0.0 through 1.0.16 Sylius versions 1.1.0 through 1.1.8 Sylius versions 1.2.0 through 1.2.1

Description: The issue affects certain actions in the admin panel that did not require a CSRF token, including marking order's payment as completed, marking order's payment as refunded, marking product review as accepted, and marking product review as rejected. The applyStateMachineTransitionAction method in ResourceController was also vulnerable.

Recommendations: For Sylius versions 1.0.0 through 1.0.16, update to version 1.0.17 to fix the issue. For Sylius versions 1.1.0 through 1.1.8, update to version 1.1.9 to fix the issue. For Sylius versions 1.2.0 through 1.2.1, update to version 1.2.2 to fix the issue. As a temporary workaround, consider disabling the applyStateMachineTransitionAction method in ResourceController until a patch is available, or add csrf protection: false to its routing configuration if used in the API context.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

GHSA-65V7-WG35-2QPM

Affected Products

Sylius

References · 5

• https://osv.dev/vulnerability/GHSA-65v7-wg35-2qpm · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/2018-07-09.yaml · Note
• https://github.com/Sylius/SyliusResourceBundle · Note
• https://github.com/Sylius/SyliusResourceBundle/commit/9720ac5a0a39ea2c2a395ef16a94a00aa86c418b · Note
• https://sylius.com/blog/csrf-vulnerability-in-admin-panel · Note