The Spree team was recently alerted to several potential security vulnerabilities. If you believe you’ve found a security vulnerability, please do not post publicly about it. Email us at firstname.lastname@example.org and we will investigate and fix the issue as quickly as possible.
Spree Roles Mass-assignment Vulnerability
The first vulnerability reported pertains to a mass-assignment vulnerability with spree roles. By passing the right parameters while updating a user, that user is able to assign any existing role to themselves. This is fixed in the latest release. You are strongly encouraged to upgrade if you are using Spree 1.1.x, 1.2.x or 1.3.×.
Thanks to Laurens Nienhaus of asdfasdf.de, Web Entwicklung for reporting this.
1.2.x, 1.3.x, Edge
If you are using spree_auth_devise, run the following command to update to the latest version:
bundle update spree_auth_devise
It’s recommended that you update to v1.1.6. This release contains the security fix.
JSON Gem Object Creation Vulnerability
The second is related to an Unsafe Object Creation vulnerability found in the JSON gem. This vulnerability potentially affects all versions of Spree that are running an outdated JSON gem.
The problem is not with Spree itself but the json gem upon which it relies. By using the suggested fix below you can ensure you are running a secure version of the json gem.
This is easily fixed by upgrading to the latest version of the JSON gem, which can be done by running the following command:
We have added a hard dependency on JSON to spree_core to ensure that in future versions of Spree you are using an unaffected version of the gem.
Thanks to Steve Root of Roots Kitchens Bedrooms Bathrooms for bringing this to our attention. More info on this vulnerability can be found on the rails-security group.
Unsafe Use of Constantize in Admin
The third vulnerability concerns unsafe reflections in parts of the Spree admin and affects any version of Spree >= 1.0.0. It is possible to instantiate an object of the user’s choice by passing the correct parameters to certain methods. As this vulnerability only pertains to the admin interface, we have not released a new version of Spree with this fix. However, this fix is available on Spree’s master branch as commit 70092eb.
Thanks to Gabriel Quadros of Conviso Application Security for reporting this.
Spree 1.0.x – 1.3.x, Edge
The problem can be addressed by updating to edge Spree. There is no urgent need to upgrade if you are running an affected version as long as your admin users can be trusted to not attempt a complicated technical exploit of this vulnerability.