Vulnerability-Lookup

GSD-2021-41274

Vulnerability from gsd - Updated: 2021-11-18 00:00

Details

### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: - Executed whether as: - A `before_action` callback (the default) - A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). - Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. ### Patches Users should promptly update to `solidus_auth_devise` version `2.5.4`. ### Workarounds A couple of options: - If possible, change your strategy to `:exception`: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` - Add the following to `config/application.rb` to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` - We've also released new Solidus versions monkey patching `solidus_auth_devise` with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` & `v2.11.12`. See [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g) for details. ### References - [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf) - [Solidus security](https://solidus.io/security/)

Aliases

CVE-2021-41274

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-41274",
    "description": "solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.",
    "id": "GSD-2021-41274"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "solidus_auth_devise",
            "purl": "pkg:gem/solidus_auth_devise"
          }
        }
      ],
      "aliases": [
        "CVE-2021-41274",
        "GHSA-xm34-v85h-9pg2"
      ],
      "details": "### Impact\nCSRF vulnerability that allows user account takeover.\n\nAll applications using any version of the frontend component of `solidus_auth_devise`\nare affected if `protect_from_forgery` method is both:\n- Executed whether as:\n  - A `before_action` callback (the default)\n  - A `prepend_before_action` (option `prepend: true` given) before the\n    `:load_object` hook in `Spree::UserController` (most likely order to find).\n- Configured to use `:null_session` or `:reset_session` strategies\n  (`:null_session` is the default in case the no strategy is given, but\n  `rails --new` generated skeleton use `:exception`).\n\nThat means that applications that haven\u0027t been configured differently from\nwhat it\u0027s generated with Rails aren\u0027t affected.\n\n### Patches\nUsers should promptly update to `solidus_auth_devise` version `2.5.4`.\n\n### Workarounds\nA couple of options:\n\n- If possible, change your strategy to `:exception`:\n  ```ruby\n  class ApplicationController \u003c ActionController::Base\n\n     protect_from_forgery with: :exception\n  end\n  ```\n\n- Add the following to `config/application.rb` to at least run the `:exception`\n  strategy on the affected controller:\n  ```ruby\n  config.after_initialize do\n    Spree::UsersController.protect_from_forgery\n  with: :exception\n  end\n  ```\n\n- We\u0027ve also released new Solidus versions monkey patching `solidus_auth_devise`\n  with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` \u0026 `v2.11.12`. See\n  [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g)\n  for details.\n\n### References\n- [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)\n- [Solidus security](https://solidus.io/security/)\n",
      "id": "GSD-2021-41274",
      "modified": "2021-11-18T00:00:00.000Z",
      "published": "2021-11-18T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 9.3,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Authentication Bypass by CSRF Weakness"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-41274",
        "STATE": "PUBLIC",
        "TITLE": "Authentication Bypass by CSRF Weakness"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "solidus_auth_devise",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 1.0.0, \u003c 2.5.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "solidusio"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-352: Cross-Site Request Forgery (CSRF)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2",
            "refsource": "CONFIRM",
            "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
          },
          {
            "name": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555",
            "refsource": "MISC",
            "url": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-xm34-v85h-9pg2",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2021-41274",
      "cvss_v3": 9.3,
      "date": "2021-11-18",
      "description": "### Impact\nCSRF vulnerability that allows user account takeover.\n\nAll applications using any version of the frontend component of `solidus_auth_devise`\nare affected if `protect_from_forgery` method is both:\n- Executed whether as:\n  - A `before_action` callback (the default)\n  - A `prepend_before_action` (option `prepend: true` given) before the\n    `:load_object` hook in `Spree::UserController` (most likely order to find).\n- Configured to use `:null_session` or `:reset_session` strategies\n  (`:null_session` is the default in case the no strategy is given, but\n  `rails --new` generated skeleton use `:exception`).\n\nThat means that applications that haven\u0027t been configured differently from\nwhat it\u0027s generated with Rails aren\u0027t affected.\n\n### Patches\nUsers should promptly update to `solidus_auth_devise` version `2.5.4`.\n\n### Workarounds\nA couple of options:\n\n- If possible, change your strategy to `:exception`:\n  ```ruby\n  class ApplicationController \u003c ActionController::Base\n\n     protect_from_forgery with: :exception\n  end\n  ```\n\n- Add the following to `config/application.rb` to at least run the `:exception`\n  strategy on the affected controller:\n  ```ruby\n  config.after_initialize do\n    Spree::UsersController.protect_from_forgery\n  with: :exception\n  end\n  ```\n\n- We\u0027ve also released new Solidus versions monkey patching `solidus_auth_devise`\n  with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` \u0026 `v2.11.12`. See\n  [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g)\n  for details.\n\n### References\n- [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)\n- [Solidus security](https://solidus.io/security/)\n",
      "gem": "solidus_auth_devise",
      "ghsa": "xm34-v85h-9pg2",
      "patched_versions": [
        "\u003e= 2.5.4"
      ],
      "title": "Authentication Bypass by CSRF Weakness",
      "unaffected_versions": [
        "\u003c 1.0.0"
      ],
      "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=1.0.0 \u003c2.5.4",
          "affected_versions": "All versions starting from 1.0.0 before 2.5.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-352",
            "CWE-937"
          ],
          "date": "2021-11-24",
          "description": "solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem.Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`).",
          "fixed_versions": [
            "2.5.4"
          ],
          "identifier": "CVE-2021-41274",
          "identifiers": [
            "CVE-2021-41274",
            "GHSA-xm34-v85h-9pg2"
          ],
          "not_impacted": "All versions before 1.0.0, all versions starting from 2.5.4",
          "package_slug": "gem/solidus_auth_devise",
          "pubdate": "2021-11-17",
          "solution": "Upgrade to version 2.5.4 or above.",
          "title": "Cross-Site Request Forgery (CSRF)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-41274",
            "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2",
            "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555"
          ],
          "uuid": "13293296-6f7f-4f19-a2a3-edcbeb474128"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:nebulab:solidus_auth_devise:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.5.4",
                "versionStartIncluding": "1.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41274"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-352"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
            },
            {
              "name": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-11-24T04:48Z",
      "publishedDate": "2021-11-17T20:15Z"
    }
  }
}

CVE-2021-41274 (GCVE-0-2021-41274)

Vulnerability from cvelistv5 – Published: 2021-11-17 19:55 – Updated: 2024-08-04 03:08

Title

Authentication Bypass by CSRF Weakness

Summary

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7805 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/solidusio/solidus_auth_devise/…	x_refsource_CONFIRM
https://github.com/solidusio/solidus_auth_devise/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
solidusio	solidus_auth_devise	Affected: >= 1.0.0, < 2.5.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:08:31.696Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "solidus_auth_devise",
          "vendor": "solidusio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.5.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-17T19:55:11.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555"
        }
      ],
      "source": {
        "advisory": "GHSA-xm34-v85h-9pg2",
        "discovery": "UNKNOWN"
      },
      "title": "Authentication Bypass by CSRF Weakness",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41274",
          "STATE": "PUBLIC",
          "TITLE": "Authentication Bypass by CSRF Weakness"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "solidus_auth_devise",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.0.0, \u003c 2.5.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "solidusio"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352: Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2",
              "refsource": "CONFIRM",
              "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
            },
            {
              "name": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555",
              "refsource": "MISC",
              "url": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-xm34-v85h-9pg2",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41274",
    "datePublished": "2021-11-17T19:55:11.000Z",
    "dateReserved": "2021-09-15T00:00:00.000Z",
    "dateUpdated": "2024-08-04T03:08:31.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-XM34-V85H-9PG2

Vulnerability from github – Published: 2021-11-18 20:09 – Updated: 2021-11-17 19:57

Summary

Authentication Bypass by CSRF Weakness

Details

Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of solidus_auth_devise are affected if protect_from_forgery method is both: - Executed whether as: - A before_action callback (the default) - A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). - Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Patches

Users should promptly update to solidus_auth_devise version 2.5.4.

Workarounds

A couple of options:

If possible, change your strategy to :exception: ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end
Add the following to config/application.rb to at least run the :exception strategy on the affected controller: ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end
We've also released new Solidus versions monkey patching solidus_auth_devise with the quick fix. Those versions are v3.1.3, v.3.0.3 & v2.11.12. See GHSA-5629-8855-gf4g for details.

References

Thanks

We'd like to thank vampire000 for reporting this issue.

For more information

If you have any questions or comments about this advisory: * Open an issue in solidus_auth_devise or a discussion in solidus * Email us at security@solidus.io * Contact the core team on Slack

Severity

9.3 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "solidus_auth_devise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41274"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-17T19:57:48Z",
    "nvd_published_at": "2021-11-17T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nCSRF vulnerability that allows user account takeover.\n\nAll applications using any version of the frontend component of  `solidus_auth_devise` are affected if `protect_from_forgery` method is both: \n- Executed whether as:\n  - A `before_action` callback (the default)\n  - A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find).\n- Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`).\n\nThat means that applications that haven\u0027t been configured differently from what it\u0027s generated with Rails aren\u0027t affected.\n\n### Patches\nUsers should promptly update to `solidus_auth_devise` version `2.5.4`.\n\n### Workarounds\nA couple of options:\n\n- If possible, change your strategy to `:exception`:\n  ```ruby\n  class ApplicationController \u003c ActionController::Base\n    protect_from_forgery with: :exception\n  end\n  ```\n\n- Add the following to `config/application.rb` to at least run the `:exception` strategy on the affected controller:\n  ```ruby\n  config.after_initialize do\n    Spree::UsersController.protect_from_forgery with: :exception\n  end\n  ```\n\n- We\u0027ve also released new Solidus versions monkey patching `solidus_auth_devise` with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` \u0026 `v2.11.12`. See [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g) for details.\n\n### References\n- [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)\n- [Solidus security](https://solidus.io/security/)\n\n### Thanks\nWe\u0027d like to thank [vampire000](https://hackerone.com/vampire000) for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)\n* Email us at [security@solidus.io](mailto:security@soliidus.io)\n* Contact the core team on [Slack](http://slack.solidus.io/)\n",
  "id": "GHSA-xm34-v85h-9pg2",
  "modified": "2021-11-17T19:57:48Z",
  "published": "2021-11-18T20:09:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41274"
    },
    {
      "type": "WEB",
      "url": "https://github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_auth_devise/CVE-2021-41274.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/solidusio/solidus_auth_devise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/solidusio/solidus_auth_devise/releases/tag/v2.5.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authentication Bypass by CSRF Weakness"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GSD-2021-41274

CVE-2021-41274 (GCVE-0-2021-41274)

GHSA-XM34-V85H-9PG2

Impact

Patches

Workarounds

References

Thanks

For more information

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour