Potential JSON hijacking in old browsers in the admin

[John Hawthorn]

Potential JSON hijacking in old browsers in the admin

Versions Affected: All versions of Spree and Solidus
Not affected: None.
Fixed Versions: Solidus 1.0.5, 1.1.3, 1.2.1
Severity: Low (assuming somewhat modern browsers)

Impact
------
This is unlikely to be exploitable on modern browsers (possibly even as old as
IE9), but we advise users to patch or upgrade out of an abundance of caution.

This is a previously discovered vulnerability, which had a security check which
was not properly implemented.
https://spreecommerce.com/blog/json-hijacking-vulnerability

JSON hijacking is an exploit which relies on a privileged JSON GET response
being valid javascript, which occurs when the top-level of the JSON is an
array.

Modern browsers do not allow intercepting array initialization, and also should
not allow execution of responses with json content type. Rails adds
X-Content-Type-Options:nosniff by default, which protects browsers as old as
IE9 from the vulnerability.

The vulnerability exists in the Admin::SearchController, which contained

before_action :check_json_authenticity, only: :index

However, there is no :index action, but a :users action exists, and is
theoretically vulnerable, as it returns a top level array.

If an admin was running a vulnerable browser, a malicious website visited by
the admin could reveal users's email, shipping, and billing addresses.


Releases
--------
The fixed releases are available on rubygems as well as in the github branches

This has been patched by modifying the users action to return an object at the
top level instead of an array.

Workarounds
-----------

It is important to note that adding the before_filter to the correct action
would not have fixed this vulnerability, as it is possible to make a request to
the endpoint in a way which does not trigger the check.

If patching is not possible, ensure admins are running an up to date browser
and that security headers are in place. Specifically "X-Content-Type-Options:
nosniff".

--
John Hawthorn