CVE-2021-43846 CSRF forgery protection bypass for Spree::OrdersController#populate

What is CVE-2021-43846?

CVE-2021-43846 is a medium-severity vulnerability in solidusio solidus, published on 20 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.

Weakness: CWE-352

Which versions are affected by CVE-2021-43846?

6 open source packages ship an affected version, including solidus_frontend. It affects 1 product.

Products include Nebulab Solidus.

How do I fix CVE-2021-43846?

Upgrade solidus_frontend to a fixed version for your release line: 2.11.14, 3.0.5 or 3.1.5.

Is CVE-2021-43846 being exploited?

There is no known exploitation of CVE-2021-43846 in the wild and no public exploit code.

Other vulnerabilities in solidusio solidus

• CVE-2021-43805 ReDos vulnerability on guest checkout email validation High 7.5
• CVE-2020-15109 Ability to change order address without triggering address validations in solidus Medium 5.3
• CVE-2022-31000 CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend Low 2.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h3fg-h5v3-vf8m.