Skip to content

Commit 81853a7

Browse files
jasnowpostmodern
jasnow
authored and
postmodern
committed
GHSA SYNC: 3 brand new advisories
1 parent fb5cfa5 commit 81853a7

File tree

3 files changed

+227
-0
lines changed

3 files changed

+227
-0
lines changed

‎gems/shakapacker/GHSA-96qw-h329-v5rg.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
gem: shakapacker
3+
ghsa: 96qw-h329-v5rg
4+
url: https://github.com/shakacode/shakapacker/security/advisories/GHSA-96qw-h329-v5rg
5+
title: Shakapacker has environment variable leak via EnvironmentPlugin
6+
that exposes secrets to client-side bundles
7+
date: 2026-01-08
8+
description: |
9+
### Summary
10+
11+
Since 2017, the default webpack plugins have passed the entire
12+
`process.env` to `EnvironmentPlugin`. This pattern exposed ALL
13+
build environment variables to client-side JavaScript bundles
14+
whenever application code (or any dependency) referenced
15+
`process.env.VARIABLE_NAME`.
16+
17+
This is not a regression - the vulnerable code has existed since
18+
the original Webpacker implementation. No recent code change
19+
in Shakapacker triggered this issue.
20+
21+
### Impact
22+
23+
Any environment variable in the build environment that is referenced
24+
in client-side code (including third-party dependencies) is embedded
25+
directly into the JavaScript bundle. This includes:
26+
27+
- `DATABASE_URL` - Database credentials
28+
- `AWS_SECRET_ACCESS_KEY` - AWS credentials
29+
- `RAILS_MASTER_KEY` - Rails encrypted credentials key
30+
- `STRIPE_SECRET_KEY`, `TWILIO_AUTH_TOKEN` - Third-party API keys
31+
- Any other secrets present in the build environment
32+
33+
**Severity**: Critical - secrets are exposed in publicly accessible
34+
JavaScript files.
35+
36+
### Root Cause
37+
38+
The original code used:
39+
```javascript
40+
new
41+
webpack.EnvironmentPlugin(process.env)
42+
```
43+
44+
This makes every environment variable available for substitution. If
45+
any code references `process.env.SECRET_KEY`, that value is embedded
46+
in the bundle.
47+
48+
### Patches
49+
50+
Upgrade to version 9.5.0 or later, which uses an allowlist approach
51+
that only exposes `NODE_ENV`, `RAILS_ENV`, and `WEBPACK_SERVE` by default.
52+
53+
### Workarounds
54+
55+
If developers cannot upgrade immediately:
56+
1. Audit client-side code and dependencies for any `process.env.X`
57+
references to sensitive variables
58+
2. Remove sensitive variables from the build environment
59+
3. Override the default plugins with a custom webpack/rspack
60+
config using an explicit allowlist
61+
62+
### Migration
63+
64+
After upgrading, if client-side code needs access to specific environment
65+
variables:
66+
67+
**Option 1: Use the `SHAKAPACKER_PUBLIC_` prefix (recommended)**
68+
```bash
69+
# Variables with this prefix are automatically exposed
70+
export SHAKAPACKER_PUBLIC_API_URL=\"https://api.example.com\"
71+
```
72+
73+
**Option 2: Use `SHAKAPACKER_ENV_VARS`**
74+
```bash
75+
SHAKAPACKER_ENV_VARS=API_URL,FEATURE_FLAG
76+
bundle exec rails assets:precompile
77+
```
78+
79+
### Action Required
80+
81+
After upgrading, **rotate any secrets** that may have been exposed
82+
in previously compiled JavaScript bundles.
83+
cvss_v3: 7.5
84+
patched_versions:
85+
- ">= 9.5.0"
86+
related:
87+
url:
88+
- https://github.com/shakacode/shakapacker/security/advisories/GHSA-96qw-h329-v5rg
89+
- https://github.com/shakacode/shakapacker/pull/857
90+
- https://github.com/shakacode/shakapacker/commit/3e06781b18383c5c2857ed3a722f7b91bdc1bc0e
91+
- https://github.com/advisories/GHSA-96qw-h329-v5rg

‎gems/spree_api/CVE-2026-22588.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
gem: spree_api
3+
cve: 2026-22588
4+
ghsa: g268-72p7-9j6j
5+
url: https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j
6+
title: Spree API has Authenticated Insecure Direct Object Reference
7+
(IDOR) via Order Modification
8+
date: 2026-01-08
9+
description: |
10+
### Summary
11+
12+
An Authenticated Insecure Direct Object Reference (IDOR)
13+
vulnerability was identified that allows an authenticated user to
14+
retrieve other users’ address information by modifying an existing order.
15+
By editing an order they legitimately own and manipulating address
16+
identifiers in the request, the backend server accepts and processes
17+
references to addresses belonging to other users, subsequently
18+
associating those addresses with the attacker’s order and returning
19+
them in the response.
20+
21+
### Details
22+
23+
Affected Component(s)
24+
25+
- Authenticated user order management
26+
- Address association logic
27+
- Order update endpoint(s)
28+
29+
Affected Endpoint(s):
30+
- `/api/v2/storefront/checkout`
31+
32+
The application fails to enforce proper object-level authorization
33+
when updating an existing order. While the user is authenticated and
34+
authorized to modify their own order, the backend does not verify
35+
that the supplied address identifiers belong to the same authenticated user.
36+
37+
**See reference below for POC.**
38+
39+
### Impact
40+
41+
As a result, an attacker can:
42+
- Replace the address identifier with one belonging to another user
43+
- Cause the backend to associate and return another user’s address
44+
within the attacker’s order"
45+
cvss_v3: 6.5
46+
unaffected_versions:
47+
- "< 3.7.0"
48+
patched_versions:
49+
- "~> 4.10.2"
50+
- "~> 5.0.7"
51+
- "~> 5.1.9"
52+
- ">= 5.2.5"
53+
related:
54+
url:
55+
- https://nvd.nist.gov/vuln/detail/CVE-2026-22588
56+
- https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j
57+
- https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72
58+
- https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3
59+
- https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8
60+
- https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7
61+
- https://github.com/advisories/GHSA-g268-72p7-9j6j

‎gems/spree_core/CVE-2026-22589.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
gem: spree_core
3+
cve: 2026-22589
4+
ghsa: 3ghg-3787-w2xr
5+
url: https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
6+
title: Spree API has Unauthenticated IDOR - Guest Address
7+
date: 2026-01-08
8+
description: |
9+
### Summary
10+
11+
An Unauthenticated Insecure Direct Object Reference (IDOR)
12+
vulnerability was identified that allows an unauthenticated attacker
13+
to access guest address information without supplying valid
14+
credentials or session cookies.
15+
16+
### Details
17+
18+
During testing, it was observed that all guest users can make an
19+
unauthenticated request to retrieve address data belonging to other
20+
guest users by manipulating object identifiers. The attacker would
21+
need to know the storefront URL structure to perform this attack
22+
(which can be learnt after creating a registered user account).
23+
24+
Affected Component(s)
25+
26+
* Address Edit endpoint: `/addresses/{addressId}/edit`
27+
28+
Root Cause
29+
- Faulty authorization check in CanCanCan Ability class:
30+
31+
```diff
32+
- can :manage, ::Spree::Address, user_id: user.id
33+
+ can :manage, ::Spree::Address, user_id: user.id if user.persisted?
34+
```
35+
36+
the `user` object in `Spree::Ability` class for guest users is
37+
a `Spree.user_class.new` object.
38+
39+
Addresses endpoint to access it is part of the `spree_storefront`
40+
gem. **Headless builds using APIs are not affected,** as the
41+
Addresses endpoint there is only for registered users, and
42+
records are scoped to the currently signed-in user.
43+
44+
### Impact
45+
46+
An unauthenticated attacker can:
47+
48+
- Enumerate and retrieve guest address information (Addresses
49+
associated with User accounts are NOT affected)
50+
- Access personally identifiable information (PII) such as:
51+
- Full names
52+
- Physical addresses
53+
- Phone numbers (if present)
54+
55+
This vulnerability could lead to:
56+
57+
- Privacy violations
58+
- Regulatory compliance issues (e.g., GDPR)
59+
- Loss of user trust"
60+
cvss_v3: 7.5
61+
unaffected_versions:
62+
- "< 4.0.0"
63+
patched_versions:
64+
- "~> 4.10.2"
65+
- "~> 5.0.7"
66+
- "~> 5.1.9"
67+
- ">= 5.2.5"
68+
related:
69+
url:
70+
- https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr
71+
- https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795
72+
- https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad
73+
- https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67
74+
- https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad
75+
- https://github.com/advisories/GHSA-3ghg-3787-w2xr

0 commit comments

Comments
 (0)