Listen to this Post
The vulnerability is an unauthenticated Insecure Direct Object Reference (IDOR) in the Spree Commerce platform, specifically within the spree_storefront gem. It allows guest users to access address information of other guest users without any authentication. The affected endpoint is /addresses/{addressId}/edit, where the addressId parameter can be manipulated. The root cause lies in the CanCanCan Ability class authorization check. For guest users, the user object is instantiated as Spree.user_class.new, which is not persisted. The ability rule “can :manage, ::Spree::Address, user_id: user.id” does not properly restrict access because for guest users, user.id is nil or not applicable, failing to enforce ownership. Consequently, when an unauthenticated request is made to the edit endpoint with a arbitrary address ID, the system retrieves and returns the address details without verifying if the requester owns that address. This occurs because the authorization check does not account for unpersisted guest user objects. The attacker only needs knowledge of the URL structure, which can be obtained by examining a registered user’s requests. The vulnerability is isolated to the storefront; headless API implementations are not affected as they scope addresses to signed-in users. Exploitation involves simply changing the numeric ID in the GET request to enumerate guest address records.
Platform: Spree Commerce
Version: Not specified
Vulnerability: IDOR
Severity: Critical
date: Not specified
Prediction: Patch date unknown
What Undercode Say:
Analytics:
curl -X GET http://localhost:3000/addresses/6/edit
curl -X GET http://localhost:3000/addresses/2/edit
Code snippet from Ability class:
can :manage, ::Spree::Address, user_id: user.id
Fixed code:
can :manage, ::Spree::Address, user_id: user.id if user.persisted?
How Exploit:
Send unauthenticated GET requests to /addresses/{id}/edit with incremented IDs to enumerate guest address data.
Protection from this CVE:
Implement proper authorization checks for guest users. Ensure user persistence is verified. Restrict endpoint access to authenticated users only.
Impact:
Unauthenticated PII access including full names and addresses. Privacy violations and GDPR compliance issues. Loss of user trust.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
