Remote Code Execution and File Disclosure Vulnerability

[John Hawthorn]

Versions Affected: All versions of Spree and Solidus (introduced in Spree 1.2)
Fixed Versions: Solidus 1.0.0.pre3

Impact
------
An attacker with API access is able to execute arbitrary files on the remote
system. It is likely that this could be leveraged to gain admin priviledges,
disclose the contents of files or execute arbitrary code.

We recommend all users upgrade immediately, but this is especially dangerous to
stores which provide API access to customers.

Workarounds
-----------
If you are unable to upgrade you can work around this vulnerability by adding
the following check through an initializer.

``` ruby
# config/initializers/security_20150727.rb
Spree::Api::TaxonomiesController.before_filter do
params[:set] = nil if params[:set] != "nested"
end
```

Patches
-------
We have provided the following patch which should apply to all
versions of Spree and Solidius

api-taxonomies-security.patch