CVE-2021-41274 Authentication Bypass by CSRF Weakness
A CSRF vulnerability in solidus_auth_devise allows attackers to take over user accounts if specific Rails forgery protection settings are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-41274?
CVE-2021-41274 is a critical vulnerability in solidusio solidus_auth_devise, published on 17 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.
Weakness: CWE-352
Which versions are affected by CVE-2021-41274?
2 open source packages ship an affected version, including solidus_auth_devise. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
solidus_auth_devise RubyGems | From 1.0.0 | 2.5.4 |
solidus_auth_devise RubyGems | From 1.0.0 | 2.5.4 |
Products include Nebulab Solidus Auth Devise.
How do I fix CVE-2021-41274?
Upgrade solidus_auth_devise to 2.5.4 or later.
Is CVE-2021-41274 being exploited?
There is no known exploitation of CVE-2021-41274 in the wild and no public exploit code.
Sources
Also known as GHSA-xm34-v85h-9pg2.