CVE-2021-32720: Sylius/sylius List Of Order Ids, Number, Vulnerability

MODERATE
Advisory Identifier: GHSA-rpxh-vg2x-526v
Share
CVSS 5.3
CWE-200
Published
Advisory Summary

CVE-2021-32720 is a MODERATE (CVSS 5.3) list of order ids, number, vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Sylius/sylius libraries in the Packagist ecosystem. The issue involves list of order ids, number, items total and token value exposed for unauthorized uses via new api. Remediation is available by upgrading affected packages to version 1.9.5.

CVE-2021-32720 at a Glance

CVE Identifier CVE-2021-32720
GHSA Identifier GHSA-rpxh-vg2x-526v
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected Product Sylius/sylius
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2021-32720

To remediate this vulnerability, upgrade all affected Sylius/sylius dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

sylius/sylius fixed: 1.9.5 
Upgrade sylius/sylius to 1.9.5
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for sylius/sylius

How to Check if You Are Affected

To determine whether your application is affected by CVE-2021-32720, inspect your project dependencies for Sylius/sylius:

inspect dependencies for sylius/sylius

Analyze the terminal output to locate any version of Sylius/sylius in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.9.5), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Sylius/sylius, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. ### Patches The problem has been patched at Sylius 1.9.5 and 1.10.0 ### Workarounds There are a few ways to fix this without updating the code. The first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. In order to achieve it one has to add the configuration in `config/packages/security.yaml`: ```yaml access_control: # ... - { path: "%sylius.security.new_api_shop_regex%/orders", role: IS_AUTHENTICATED_ANONYMOUSLY, methods: [POST] } - { path: "%sylius.security.new_api_shop_regex%/orders", role: ROLE_USER, methods: [GET] } ``` This would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only. The second possible solution is to decorate the `\Sylius\Bundle\ApiBundle\Doctrine\QueryCollectionExtension\OrdersByLoggedInUserExtension` and throw `Symfony\Component\Security\Core\Exception\AccessDeniedException` if the class is executed for unauthorized user.

CVE-2021-32720 Affected Sylius/sylius Versions

1 component(s)
Fixed Versions:
1.9.5
Product / Package Ecosystem Affected Versions Fixed Version
sylius/sylius
 Packagist
≥ 1.9.0
< 1.9.5
1.9.5

References

GitHub Advisory / Wiki ADVISORY
https://github.com/Sylius/Sylius/security/advisories/GHSA-rpxh-vg2x-526v
NVD — CVE-2021-32720 NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32720
Security Fix Commit FIX COMMIT
https://github.com/Sylius/Sylius/commit/21d509851559230d03292b2a635a6951748c2758
Sylius/sylius Release RELEASE
https://github.com/Sylius/Sylius/releases/tag/v1.9.5
packagist.org/packages/sylius/syl... WEB
https://packagist.org/packages/sylius/sylius

Frequently Asked Questions

What is CVE-2021-32720?
CVE-2021-32720 is a security vulnerability in Sylius/sylius involving List of order ids, number, items total and token value exposed for unauthorized uses via new API under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Which Sylius/sylius versions are affected?
Affected versions include releases prior to 1.9.5 across affected packages: sylius/sylius.
What version fixes CVE-2021-32720?
Upgrading to 1.9.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is sylius/sylius affected?
Yes, sylius/sylius is affected in releases prior to 1.9.5. Upgrade your dependency to 1.9.5 or later.
What is the CVSS score of CVE-2021-32720?
CVE-2021-32720 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with CVE-2021-32720?
CVE-2021-32720 is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.).
How can I check Packagist dependencies for CVE-2021-32720?
Run the dependency tree command: 'inspect dependencies for sylius/sylius'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rpxh-vg2x-526v",
  "modified" : "2021-06-30T17:59:43Z",
  "published" : "2021-06-29T03:12:04Z",
  "aliases" : [ "CVE-2021-32720" ],
  "summary" : "List of order ids, number, items total and token value exposed for unauthorized uses via new API",
  "details" : "### Impact\n\nPart of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. \n\n### Patches\n\nThe problem has been patched at Sylius 1.9.5 and 1.10.0\n\n### Workarounds\nThere are a few ways to fix this without updating the code. \n\nThe first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. In order to achieve it one has to add the configuration in `config/packages/security.yaml`:\n```yaml\n    access_control:\n        # ... \n        - { path: \"%sylius.security.new_api_shop_regex%/orders\", role: IS_AUTHENTICATED_ANONYMOUSLY, methods: [POST] }\n        - { path: \"%sylius.security.new_api_shop_regex%/orders\", role: ROLE_USER, methods: [GET] }\n```\nThis would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only.\n\nThe second possible solution is to decorate the `\\Sylius\\Bundle\\ApiBundle\\Doctrine\\QueryCollectionExtension\\OrdersByLoggedInUserExtension` and throw `Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException` if the class is executed for unauthorized user.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "sylius/sylius"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.9.0"
      }, {
        "fixed" : "1.9.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Sylius/Sylius/security/advisories/GHSA-rpxh-vg2x-526v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-32720"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Sylius/Sylius/commit/21d509851559230d03292b2a635a6951748c2758"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Sylius/Sylius/releases/tag/v1.9.5"
  }, {
    "type" : "WEB",
    "url" : "https://packagist.org/packages/sylius/sylius"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-06-28T18:23:22Z",
    "nvd_published_at" : "2021-06-28T19:15:00Z"
  }
}