CVE-2020-15109 Ability to change order address without triggering address validations in solidus
Attackers can modify order addresses without triggering validation, bypassing shipment cost calculations in stores with multiple shipping zones.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15109?
CVE-2020-15109 is a medium-severity vulnerability in solidusio solidus, published on 4 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.
Which versions are affected by CVE-2020-15109?
12 open source packages ship an affected version, including solidus_api and solidus_frontend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
solidus_api RubyGems | All versions | 2.8.6 |
solidus_api RubyGems | All versions | 2.8.6 |
solidus_api RubyGems | From 2.10.0 | 2.10.2 |
solidus_api RubyGems | From 2.10.0 | 2.10.2 |
solidus_api RubyGems | From 2.9.0 | 2.9.6 |
solidus_api RubyGems | From 2.9.0 | 2.9.6 |
6 more packages
solidus_frontend RubyGems | All versions | 2.8.6 |
solidus_frontend RubyGems | All versions | 2.8.6 |
solidus_frontend RubyGems | From 2.10.0 | 2.10.2 |
solidus_frontend RubyGems | From 2.10.0 | 2.10.2 |
solidus_frontend RubyGems | From 2.9.0 | 2.9.6 |
solidus_frontend RubyGems | From 2.9.0 | 2.9.6 |
Products include Nebulab Solidus.
How do I fix CVE-2020-15109?
Upgrade solidus_api to a fixed version for your release line: 2.8.6, 2.10.2 or 2.9.6.
Is CVE-2020-15109 being exploited?
There is no known exploitation of CVE-2020-15109 in the wild and no public exploit code.
Other vulnerabilities in solidusio solidus
Sources
Also known as GHSA-3mvg-rrrw-m7ph.