-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| spree_core | rubygems | >= 4.0.0, < 4.10.2 | 4.10.2 |
| spree_core | rubygems | >= 5.0.0, < 5.0.7 | 5.0.7 |
| spree_core | rubygems | >= 5.1.0, < 5.1.9 | 5.1.9 |
| spree_core | rubygems | >= 5.2.0, < 5.2.5 | 5.2.5 |
Miggo AIRoot Cause AnalysisThe vulnerability is an Insecure Direct Object Reference (IDOR) in the Spree storefront that allows an unauthenticated attacker to access and manage the addresses of guest users. The root cause is a faulty authorization check in the Spree::Ability class (and Spree::PermissionSets::DefaultCustomer in some versions). The rule can :manage, ::Spree::Address, user_id: user.id was applied to guest users, for whom the user.id is nil. This allowed any guest to manage any address where the user_id was also nil, which corresponds to addresses created by other guests. The exploit occurs when an attacker makes a request to endpoints in Spree::AddressesController, such as /addresses/{id}/edit. The patch addresses the root cause by adding a user.persisted? check, ensuring the rule only applies to authenticated, registered users. It also adds a defense-in-depth measure by requiring authentication for all actions in the Spree::AddressesController via a before_action :require_user.
Spree::AddressesController.editstorefront/app/controllers/spree/addresses_controller.rb
Spree::AddressesController.updatestorefront/app/controllers/spree/addresses_controller.rb
Spree::AddressesController.destroystorefront/app/controllers/spree/addresses_controller.rb
Spree::Ability.apply_user_permissionscore/app/models/spree/ability.rb
Spree::PermissionSets::DefaultCustomer.activate!core/app/models/spree/permission_sets/default_customer.rb