Greg Knaddison

A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.

An incorrect authorization issue exists in the module used for organizing tangible products into shipments for fulfillment. The system fails to sufficiently verify access permissions on the form used to resend receipts. Under specific configurations, this allows unauthorized users to perform forceful browsing to access receipts and sensitive customer information for orders they are not permitted to view.

Incorrectly configured access control security levels in the AI Search submodule allow the web browser cache to contain sensitive information. While the AI Search backend verifies access for each search result, this check is ignored when Search API caches view results. Consequently, users may see cached search results, such as titles and fields of unpublished or restricted content, if a user with appropriate permissions performed the same search within the cache lifetime. This occurs when the AI Search submodule is enabled and a Search API view uses time-based, tag-based, or combined time and tag-based result caching.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently validate Markdown links under certain conditions, which can lead to the execution of malicious scripts in the user's browser.

Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The AI Automator submodule, which enables automatic field population based on other fields, fails to sufficiently verify access to text formats. This allows users to author field data using text formats they are not authorized to use.

An incorrect authorization issue allows forceful browsing within the module used for organizing tangible products into shipments for fulfillment. The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass. This can result in the unauthorized modification of shipment states or the deletion of shipments. Exploitation requires the attacker to possess a cart with API-based access to manipulate shipments.

An issue exists where the module does not sufficiently restrict product variations returned by entity queries to those the current user is authorized to view. When the core JSON:API module is enabled, an attacker can perform forceful browsing by making repeated requests to determine field values of unpublished product variations or variations of unpublished products.

Cross-Site Request Forgery (CSRF) occurs when a user is tricked into performing an action they did not intend to do. In this case, routes for the inbox do not verify CSRF tokens. An attacker can deceive a user with the "access commerce administration pages" permission into visiting a malicious page that dismisses notifications. Because the inbox is shared, this action hides messages, including security update notices, from all administrators.

An issue in the AI Chatbot submodule occurs when user input is not sufficiently filtered before being rendered on a web page, leading to Cross-Site Scripting (XSS). This occurs under certain configurations and requires the attacker to have permissions to administer blocks.

Incorrect authorization in the AI module allows resource injection. The module fails to sufficiently validate links under specific conditions, which could lead to the exfiltration of sensitive information to external sites. This occurs when an attacker uses untrusted sources to interact with the module in a manner that produces rendered HTML.

Insecure storage of sensitive information occurs when audio files for speech-to-text requests are written to a single file in the temporary directory and are not deleted after processing. This allows an attacker with read access to the site's temporary directory—potentially via shared hosting or other code exposing temporary files—to retrieve audio data sent by other users for transcription.

This module provides a framework for integrating AI providers and features into Drupal. The issue occurs because the module does not sufficiently sanitize certain HTMX attributes, leading to Cross-Site Scripting (XSS), where malicious scripts can be injected into web pages.

An authentication bypass exists in the module that enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in, the module attempts to link the user to an existing account sharing the same email address. This allows an attacker to take over any existing Drupal account, excluding user 1, provided the account has not yet been linked to an OpenID Connect user. This issue is more likely to occur if the site is configured to use a provider that does not verify user email addresses.

An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to license fields for users possessing the `update own commerce license` permission. Consequently, a license owner can modify the license state and the rights granted by their license, potentially leading to privilege escalation up to the Administrator role.

An incorrect authorization issue allows forceful browsing when Drupal Commerce is used in conjunction with the JSON:API module. This allows users without proper permissions to access unpublished product variations. This issue specifically affects sites that maintain both published products and unpublished product variations.

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access to the relationship between promotions and coupons. Consequently, a user authorized only to manage their own promotions can modify or delete coupons associated with other promotions. This issue is mitigated if the site does not enable writes through JSON:API or REST, as these are disabled by default.

An incorrect authorization issue allows forceful browsing when a store is saved. The system fails to properly verify access permissions, enabling a user with the ability to create stores or edit their own store to mark it as the site's default store. This allows the user to receive orders they are not authorized to access. This issue primarily impacts sites that grant these permissions to untrusted users, such as marketplace platforms where vendors manage their own stores.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The module does not sufficiently restrict HTML rendering, which enables the execution of malicious scripts under certain conditions. This issue is mitigated by the requirement that an attacker must have access to a text format capable of rendering HTML.

Improper verification of cryptographic signatures in the module allows for signature spoofing. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook event signatures. Webhooks are automated messages sent from Stripe to the application to notify it about events, such as successful payments.