Jonathan Sacksick

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

An incorrect authorization issue allows forceful browsing when Drupal Commerce is used in conjunction with the JSON:API module. This allows users without proper permissions to access unpublished product variations. This issue specifically affects sites that maintain both published products and unpublished product variations.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access to the relationship between promotions and coupons. Consequently, a user authorized only to manage their own promotions can modify or delete coupons associated with other promotions. This issue is mitigated if the site does not enable writes through JSON:API or REST, as these are disabled by default.

An incorrect authorization issue allows forceful browsing when a store is saved. The system fails to properly verify access permissions, enabling a user with the ability to create stores or edit their own store to mark it as the site's default store. This allows the user to receive orders they are not authorized to access. This issue primarily impacts sites that grant these permissions to untrusted users, such as marketplace platforms where vendors manage their own stores.

Cross-Site Request Forgery (CSRF) occurs when a user is tricked into performing an action they did not intend to do. In this case, routes for the inbox do not verify CSRF tokens. An attacker can deceive a user with the "access commerce administration pages" permission into visiting a malicious page that dismisses notifications. Because the inbox is shared, this action hides messages, including security update notices, from all administrators.

An issue exists where the module does not sufficiently restrict product variations returned by entity queries to those the current user is authorized to view. When the core JSON:API module is enabled, an attacker can perform forceful browsing by making repeated requests to determine field values of unpublished product variations or variations of unpublished products.

An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to license fields for users possessing the `update own commerce license` permission. Consequently, a license owner can modify the license state and the rights granted by their license, potentially leading to privilege escalation up to the Administrator role.

An incorrect authorization issue allows forceful browsing within the module used for organizing tangible products into shipments for fulfillment. The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass. This can result in the unauthorized modification of shipment states or the deletion of shipments. Exploitation requires the attacker to possess a cart with API-based access to manipulate shipments.

An incorrect authorization issue exists in the module used for organizing tangible products into shipments for fulfillment. The system fails to sufficiently verify access permissions on the form used to resend receipts. Under specific configurations, this allows unauthorized users to perform forceful browsing to access receipts and sensitive customer information for orders they are not permitted to view.

A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). This issue occurs when the module is used to configure the store via the Stripe Connect API. Exploitation requires the attacker to possess administrator permissions to configure payment gateways and the simultaneous compromise of an external service.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment.

Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The module fails to sufficiently sanitize customer comments within the order receipt email template. This issue specifically affects installations where the `commerce checkout` module is enabled and the `customer comments` checkout pane is explicitly used, as this pane is disabled by default.