{"answers":{"affected":"8 open source packages ship an affected version, including spree_auth_devise. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-41275 in the wild and no public exploit code.","fix":"Upgrade spree_auth_devise to a fixed version for your release line: 4.0.1, 4.1.1, 4.2.1 or 4.4.1.","what":"CVE-2021-41275 is a critical vulnerability in spree_auth_devise, published on 17 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2021-41275 and fix it if it is affected.\n\nWhat it is: CVE-2021-41275 is a critical vulnerability in spree_auth_devise, published on 17 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2021-41275 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- spree_auth_devise (RubyGems): affected all versions; fixed in 4.0.1\n- spree_auth_devise (RubyGems): affected all versions; fixed in 4.0.1\n- spree_auth_devise (RubyGems): affected from 4.1.0; fixed in 4.1.1\n- spree_auth_devise (RubyGems): affected from 4.1.0; fixed in 4.1.1\n- spree_auth_devise (RubyGems): affected from 4.2.0; fixed in 4.2.1\n- spree_auth_devise (RubyGems): affected from 4.2.0; fixed in 4.2.1\n- spree_auth_devise (RubyGems): affected from 4.3.0; fixed in 4.4.1\n- spree_auth_devise (RubyGems): affected from 4.3.0; fixed in 4.4.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-41275/ (Markdown: https://insights.sbomify.com/CVE-2021-41275/index.md)","id":"CVE-2021-41275","markdown":"https://insights.sbomify.com/CVE-2021-41275/index.md","name":"CVE-2021-41275","record":{"aliases":["GHSA-26xx-m4q2-xhq8"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Spree authentication library","requires_auth":"none","summary":"A CSRF vulnerability in spree_auth_devise allows attackers to take over user accounts when specific Rails forgery protection strategies are configured.","user_interaction":"required","vuln_class":"csrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"spree_auth_devise","vendor":"spreecommerce"}],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"description":"spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch �� ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController \u003c ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2","ecosystems":["RubyGems"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Authentication Bypass by CSRF Weakness","id":"CVE-2021-41275","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"csrf","year":"2021"},"n_packages":8,"n_references":2,"next":{"headline":"Indirect LDAP injection in Tuleap","id":"CVE-2021-41276"},"packages":[{"ecosystem":"RubyGems","fixed":["4.0.1"],"introduced":["0"],"last_affected":[],"package":"spree_auth_devise","purl":null,"source":"GHSA-26xx-m4q2-xhq8"},{"ecosystem":"RubyGems","fixed":["4.0.1"],"introduced":["0"],"last_affected":[],"package":"spree_auth_devise","purl":"pkg:gem/spree_auth_devise","source":"GHSA-26xx-m4q2-xhq8"},{"ecosystem":"RubyGems","fixed":["4.1.1"],"introduced":["4.1.0"],"last_affected":[],"package":"spree_auth_devise","purl":null,"source":"GHSA-26xx-m4q2-xhq8"},{"ecosystem":"RubyGems","fixed":["4.1.1"],"introduced":["4.1.0"],"last_affected":[],"package":"spree_auth_devise","purl":"pkg:gem/spree_auth_devise","source":"GHSA-26xx-m4q2-xhq8"},{"ecosystem":"RubyGems","fixed":["4.2.1"],"introduced":["4.2.0"],"last_affected":[],"package":"spree_auth_devise","purl":null,"source":"GHSA-26xx-m4q2-xhq8"},{"ecosystem":"RubyGems","fixed":["4.2.1"],"introduced":["4.2.0"],"last_affected":[],"package":"spree_auth_devise","purl":"pkg:gem/spree_auth_devise","source":"GHSA-26xx-m4q2-xhq8"},{"ecosystem":"RubyGems","fixed":["4.4.1"],"introduced":["4.3.0"],"last_affected":[],"package":"spree_auth_devise","purl":null,"source":"GHSA-26xx-m4q2-xhq8"},{"ecosystem":"RubyGems","fixed":["4.4.1"],"introduced":["4.3.0"],"last_affected":[],"package":"spree_auth_devise","purl":"pkg:gem/spree_auth_devise","source":"GHSA-26xx-m4q2-xhq8"}],"prev":{"headline":"Authentication Bypass by CSRF Weakness","id":"CVE-2021-41274"},"products":["spree_auth_devise"],"published":"2021-11-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["spree"]},"summary":"A CSRF vulnerability in spree_auth_devise allows attackers to take over user accounts when specific Rails forgery protection strategies are configured.","url":"https://insights.sbomify.com/CVE-2021-41275/"}