GHSA-65v7-wg35-2qpm Sylius Resource Bundle Cross-Site Request Forgery vulnerability
Attackers can trick authenticated admins into modifying order payments or product reviews without CSRF protection.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-65v7-wg35-2qpm?
GHSA-65v7-wg35-2qpm is a vulnerability in sylius/resource-bundle, published on 29 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Sylius 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, 1.2.0 to 1.2.1 versions of AdminBundle and ResourceBundle are affected by this security issue.
This issue has been fixed in Sylius 1.0.17, 1.1.9 and 1.2.2. Development branch for 1.3 release has also been fixed.
Description
The following actions in the admin panel did not require a CSRF token:
- marking order’s payment as completed
- marking order’s payment as refunded
- marking product review as accepted
- marking product review as rejected
Resolution
The issue is fixed by adding a required CSRF token to those actions.
We also fixed ResourceController‘s applyStateMachineTransitionAction method by adding a CSRF token check. If you use that action in the API context, you can disable it by adding csrf_protection: false to its routing configuration
Which versions are affected by GHSA-65v7-wg35-2qpm?
6 open source packages ship an affected version, including sylius/resource-bundle.
| Package | Affected | Fixed in |
|---|---|---|
sylius/resource-bundle Packagist | From 1.0.0 | 1.0.17 |
sylius/resource-bundle Packagist | From 1.0.0 | 1.0.17 |
sylius/resource-bundle Packagist | From 1.1.0 | 1.1.9 |
sylius/resource-bundle Packagist | From 1.1.0 | 1.1.9 |
sylius/resource-bundle Packagist | From 1.2.0 | 1.2.2 |
sylius/resource-bundle Packagist | From 1.2.0 | 1.2.2 |
How do I fix GHSA-65v7-wg35-2qpm?
Upgrade sylius/resource-bundle to a fixed version for your release line: 1.0.17, 1.1.9 or 1.2.2.
Is GHSA-65v7-wg35-2qpm being exploited?
There is no known exploitation of GHSA-65v7-wg35-2qpm in the wild and no public exploit code.