Unauthenticated manipulation of payments in solidus_gateway

[John Hawthorn]

Unauthenticated manipulation of payments in solidus_gateway

Versions Affected: solidus_gateway - all versions
spree_gateway - 2.0+ (2012-)
spree_skrill - all versions
Fixed Versions: solidus_gateway 1.2.0
Severity: Medium

Impact
------

A lack of authentication in the Skrill integration in these gems could allow a
malicious user to craft requests to manipulate payments.

This vulnerability affects all stores including solidus_gateway or
spree_gateway, even if they aren't using the Skrill integration.

Releases
--------

Because of this vulnerability, and because it was non-functional for legitimate
use, we have removed the Skrill integration from solidus_gateway. Because it
was no longer working, I don't think anyone was using this functionality. If
you are using the Skrill integration please get in contact with me (@jhawthorn)
or one of the other core team members in the Solidus slack.

solidus_gateway 1.2.0, with this vulnerable code removed, is available on
rubygems and in the github branches. All users should upgrade immediately.



Workarounds
-----------

If for some reason you are unable to upgrade, the offending code can be removed
from an initializer.

# config/initializers/security-2017-07-24.rb
Rails.application.config.to_prepare do
Spree::SkrillStatusController.send(:remove_method, :update) rescue nil
Spree::CheckoutController.send(:remove_method, :skrill_return) rescue nil
end


--
John Hawthorn