<p>Spree Commerce has recently addressed two critical security vulnerabilities affecting the platform, which could potentially expose personal information of users. Both vulnerabilities allow unauthenticated users to access sensitive data without proper authorization.</p>
<h3>Vulnerability in Spree API: Guest Address Exposure</h3>
<p>A major issue identified as an Insecure Direct Object Reference (IDOR) vulnerability was found in Spree Commerce’s API. This flaw permits unauthenticated guest users to access the personal information of other guests by altering the plain ID parameters related to addresses (such as <code>bill_address_id</code> and <code>ship_address_id</code>) during the checkout process. The vulnerability circumvents ownership validation, which is only applied to nested attributes, leaving plain ID parameters exposed. As a result, attackers can sequentially enumerate address IDs to retrieve sensitive data such as names, addresses, and phone numbers of other guests. Patches have been released for versions 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2+ to mitigate this risk.</p>
<h3>Vulnerability in Spree Storefront: Unauthorized Order Access</h3>
<p>Another critical vulnerability was found in the Spree Storefront, allowing unauthenticated users to view completed guest orders simply by knowing the Order ID. This issue arises because the <code>OrdersController#show</code> action doesn’t adequately enforce the order token validation for accessing guest orders, opening the door to potential Personal Identifiable Information (PII) disclosure through brute force attacks. The issue, identified as CWE-639, was discovered by the GitHub Security Lab. To address this, patches have been provided for the same set of versions: 5.0.8, 5.1.10, 5.2.7, and 5.3.2+.</p>
<p>In response to these vulnerabilities, Spree Commerce strongly recommends upgrading to the patched versions to enhance the security and privacy of users. Regular updates and adherence to the latest security practices are vital to protect against such vulnerabilities.</p>


Collections

Spree Commerce patched two critical security vulnerabilities that allowed unauthenticated users to access sensitive guest data. The first vulnerability (IDOR) enabled attackers to enumerate and retrieve guest addresses by manipulating ID parameters during checkout. The second flaw allowed unauthorized viewing of completed guest orders through inadequate order token validation. Patches are available for versions 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2+, with immediate upgrades strongly recommended.

Spree Commerce Security Vulnerabilities: Access to Guest Addresses and Orders by Unauthenticated Users