CVE-2021-41274.yml

---
gem: solidus_auth_devise
cve: 2021-41274
ghsa: xm34-v85h-9pg2
url: https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
title: Authentication Bypass by CSRF Weakness
date: 2021-11-18
description: |
  ### Impact
  CSRF vulnerability that allows user account takeover.

  All applications using any version of the frontend component of `solidus_auth_devise`
  are affected if `protect_from_forgery` method is both:
  - Executed whether as:
    - A `before_action` callback (the default)
    - A `prepend_before_action` (option `prepend: true` given) before the
      `:load_object` hook in `Spree::UserController` (most likely order to find).
  - Configured to use `:null_session` or `:reset_session` strategies
    (`:null_session` is the default in case the no strategy is given, but
    `rails --new` generated skeleton use `:exception`).

  That means that applications that haven't been configured differently from
  what it's generated with Rails aren't affected.

  ### Patches
  Users should promptly update to `solidus_auth_devise` version `2.5.4`.

  ### Workarounds
  A couple of options:

  - If possible, change your strategy to `:exception`:
    ```ruby
    class ApplicationController < ActionController::Base

       protect_from_forgery with: :exception
    end
    ```

  - Add the following to `config/application.rb` to at least run the `:exception`
    strategy on the affected controller:
    ```ruby
    config.after_initialize do
      Spree::UsersController.protect_from_forgery
    with: :exception
    end
    ```

  - We've also released new Solidus versions monkey patching `solidus_auth_devise`
    with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` & `v2.11.12`. See
    [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g)
    for details.

  ### References
  - [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)
  - [Solidus security](https://solidus.io/security/)
cvss_v3: 9.3
unaffected_versions:
  - "< 1.0.0"
patched_versions:
  - ">= 2.5.4"