GHSA-5629-8855-gf4g Authentication Bypass by CSRF Weakness
Attackers can bypass authentication via CSRF to take over user accounts in Solidus e-commerce applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-5629-8855-gf4g?
GHSA-5629-8855-gf4g is a vulnerability in solidus_core, published on 18 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
The actual vulnerability has been discovered on solidus_auth_devise. See GHSA-xm34-v85h-9pg2 for details.
The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update solidus_auth_devise. For this reason, it has been marked as low impact on this end.
Patches
For extra security, update solidus_core to versions 3.1.3, 3.0.3 or 2.11.12.
Workarounds
Look at the workarounds described at GHSA-xm34-v85h-9pg2.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in solidus_auth_devise or a discussion in solidus
- Email us at [email protected]
- Contact the core team on Slack
Which versions are affected by GHSA-5629-8855-gf4g?
6 open source packages ship an affected version, including solidus_core.
| Package | Affected | Fixed in |
|---|---|---|
solidus_core RubyGems | All versions | 2.11.12 |
solidus_core RubyGems | All versions | 2.11.12 |
solidus_core RubyGems | From 3.0.0 | 3.0.3 |
solidus_core RubyGems | From 3.0.0 | 3.0.3 |
solidus_core RubyGems | From 3.1.0 | 3.1.3 |
solidus_core RubyGems | From 3.1.0 | 3.1.3 |
How do I fix GHSA-5629-8855-gf4g?
Upgrade solidus_core to a fixed version for your release line: 2.11.12, 3.0.3 or 3.1.3.
Is GHSA-5629-8855-gf4g being exploited?
There is no known exploitation of GHSA-5629-8855-gf4g in the wild and no public exploit code.