GHSA-qxmr-qxh6-2cc9

Suggest an improvement
Source
https://github.com/advisories/GHSA-qxmr-qxh6-2cc9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-qxmr-qxh6-2cc9/GHSA-qxmr-qxh6-2cc9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qxmr-qxh6-2cc9
Aliases
Published
2021-12-07T22:01:47Z
Modified
2023-11-01T04:56:45.215318Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ReDos vulnerability on guest checkout email validation
Details

Impact

Denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like a.a..

Before the patch, it can be reproduced in the console like this:

irb(main)> Spree::EmailValidator::EMAIL_REGEXP.match "a@a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.@"
processing time: 54.293660s
=> nil

To reproduce in the browser, fill in the "Customer Email" field with that fake email address during a guest checkout. Before that, you should open the browser dev tools and change the type attribute for that field from email to text. After entering a fake address and pressing the "Save & Continue" button, the browser will take a long term to perform the request before showing an error message for the invalid address. Eventually, making the email string even longer could lead to the exhaustion of server resources.

Patches

Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression.

There's an improbable chance that some orders in your system end up having associated an email address that is no longer valid. We've added a task to check precisely that:

bin/rails solidus:check_orders_with_invalid_email

The above will print information for every affected order if any.

Workarounds

If a prompt upgrade is not an option, please, add the following to config/application.rb:

config.after_initialize do
  Spree::EmailValidator.send(:remove_const, :EMAIL_REGEXP)
  Spree::EmailValidator::EMAIL_REGEXP = URI::MailTo::EMAIL_REGEXP
end

References

  • https://en.wikipedia.org/wiki/ReDoS
  • https://snyk.io/blog/redos-and-catastrophic-backtracking/

For more information

If you have any questions or comments about this advisory: * Open an issue or a discussion in Solidus. * Email us at security@solidus.io * Contact the core team on Slack

Database specific
{
    "nvd_published_at": "2021-12-07T18:15:00Z",
    "cwe_ids": [
        "CWE-1333"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-07T20:58:37Z"
}
References

Affected packages

RubyGems / solidus_core

Package

Name
solidus_core
Purl
pkg:gem/solidus_core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.11.13

Affected versions

1.*

1.0.0.pre
1.0.0.pre2
1.0.0.pre3
1.0.0.rc1
1.0.0.rc2
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.1.0.beta1
1.1.0.pre1
1.1.0.pre2
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.2.0.beta1
1.2.0.rc1
1.2.0.rc2
1.2.0
1.2.1
1.2.2
1.2.3
1.3.0.beta1
1.3.0.rc1
1.3.0.rc2
1.3.0
1.3.1
1.3.2
1.4.0.beta1
1.4.0.rc1
1.4.0
1.4.1
1.4.2

2.*

2.0.0.beta1
2.0.0.rc1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0.beta1
2.1.0.rc1
2.1.0
2.1.1
2.2.0.beta1
2.2.0.rc1
2.2.0
2.2.1
2.2.2
2.3.0.beta1
2.3.0.rc1
2.3.0.rc2
2.3.0.rc3
2.3.0
2.3.1
2.4.0.beta1
2.4.0.rc1
2.4.0
2.4.1
2.4.2
2.5.0.beta1
2.5.0.beta2
2.5.0.rc1
2.5.0
2.5.1
2.5.2
2.6.0.rc1
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0.rc.1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.10.0.beta1
2.10.0
2.10.1
2.10.2
2.10.3
2.10.5
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11.10
2.11.11
2.11.12

RubyGems / solidus_core

Package

Name
solidus_core
Purl
pkg:gem/solidus_core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.4

Affected versions

3.*

3.0.0
3.0.1
3.0.2
3.0.3

RubyGems / solidus_core

Package

Name
solidus_core
Purl
pkg:gem/solidus_core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.4

Affected versions

3.*

3.1.0
3.1.1
3.1.2
3.1.3