[Security-news] Drupal Commerce - Less Critical - Information disclosure - SA-CONTRIB-2016-019

[security-news at drupal.org]

View online: https://www.drupal.org/node/2701259

   * Advisory ID: DRUPAL-SA-CONTRIB-2016-019
   * Project: Drupal Commerce [1]     (third-party module)
   * Version: 7.x
   * Date: 2016-April-06
   * Security risk: 9/25 ( Less Critical)
     AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2]
   * Vulnerability: Information Disclosure

-------- DESCRIPTION
---------------------------------------------------------

This module enables you to build an online store that uses nodes to display
products through the use of product reference fields. The default widget for
those fields is an autocomplete textfield similar to the taxonomy term
reference field's autocomplete widget. As you type in the textfield, the
Commerce Product module returns a JSON array of matching product SKUs /
titles for you to select.

The module doesn't sufficiently restrict access to the autocomplete path
under the default configuration of the field. A visitor to the website could
browse directly to the autocomplete path to see a list of products that would
ordinarily be returned to the autocomplete JavaScript to populate the
autocomplete dropdown. Default parameters on the function used to generate
this list cause it to bypass the product access control check that would
ordinarily restrict product visibility to end users based on your site's
permissions.

This vulnerability is mitigated by the fact that an attacker must know what
the autocomplete path is and what arguments to include in it to generate a
valid response based on your site's architecture. Additionally, in most
eCommerce sites, product SKUs and titles are not by themselves considered
private information.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Drupal Commerce 7.x-1.x versions prior to 7.x-1.13.

Drupal core is not affected. If you do not use the contributed Drupal
Commerce [4] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the Drupal Commerce module for Drupal 7.x, upgrade to Drupal
     Commerce 7.x-1.13 [5]

Also see the Drupal Commerce [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Nikolay Ignatov [7]
   * Matthias Hutterer [8]

-------- FIXED BY
------------------------------------------------------------

   * Matt Glaman [9] the module co-maintainer

-------- COORDINATED BY
------------------------------------------------------

   * Klaus Purer [10] of the Drupal Security Team
   * Greg Knaddison [11] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at https://www.drupal.org/contact [12].

Learn more about the Drupal Security team and their policies [13], writing
secure code for Drupal [14], and  securing your site [15].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [16]


[1] https://www.drupal.org/project/commerce
[2] https://www.drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] https://www.drupal.org/project/commerce
[5] https://www.drupal.org/node/2701205
[6] https://www.drupal.org/project/commerce
[7] https://www.drupal.org/user/417078
[8] https://www.drupal.org/user/59747
[9] https://www.drupal.org/user/2416470
[10] https://www.drupal.org/u/klausi
[11] https://www.drupal.org/u/greggles
[12] https://www.drupal.org/contact
[13] https://www.drupal.org/security-team
[14] https://www.drupal.org/writing-secure-code
[15] https://www.drupal.org/security/secure-configuration
[16] https://twitter.com/drupalsecurity