GHSA-7563-75j9-6h5p Sensitive Information Exposure in Sylius

• Packagist sylius/sylius: < 1.9.10 → fixed in 1.9.10 • Packagist sylius/sylius: >= 1.10, < 1.10.11 → fixed in 1.10.11 • Packagist sylius/sylius: >= 1.11, < 1.11.2 → fixed in 1.11.2

Impact Any other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will block further reads. It may, however, lead to a data leak, like for example customer details, payment gateway configuration, etc.- but only if these were pages checked by the administrator. This vulnerability requires full access to the computer to take advantage of it. Patches The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2 and above. Workarounds The application must strictly redirect to the login page even when the browser back button is pressed. Another possibility is to set more strict cache policies for restricted content (like no-store). It can be achieved with the following class: ```php sectionProvider = $sectionProvider; } public static function getSubscribedEvents(): array { return [ KernelEvents::RESPONSE => 'setCacheControlDirectives', ]; } public function setCacheControlDirectives(ResponseEvent $event): void { if ( !$this->sectionProvider->getSection() instanceof AdminSection && !$this->sectionProvider->getSection() instanceof ShopCustomerAccountSubSection ) { return; } $response = $event->getResponse(); $response->headers->addCacheControlDirective('no-cache', true); $response->headers->addCacheControlDirective('max-age', '0'); $response->headers->addCacheControlDirective('must-revalidate', true); $response->headers->addCacheControlDirective('no-store', true); } } ``` After that register service in the container: ```yaml services: App\EventListener\CacheControlSubscriber: arguments: ['@sylius.section_resolver.uri_based_section_resolver'] tags: • { name: kernel.event_subscriber, event: kernel.response } ``` The code above requires changes in `ShopUriBasedSectionResolver` in order to work. To backport mentioned logic, you need to replace the `Sylius\Bundle\ShopBundle\SectionResolver\ShopUriBasedSectionResolver` class with: ```php shopCustomerAccountUri = $shopCustomerAccountUri; } public function getSection(string $uri): SectionInterface { if (str_contains($uri, $this->shopCustomerAccountUri)) { return new ShopCustomerAccountSubSection(); } return new ShopSection(); } } ``` ```yaml services: sylius.section_resolver.shop_uri_based_section_resolver: class: App\SectionResolver\ShopUriBasedSectionResolver tags: • { name: sylius.uri_based_section_resolver, priority: -10 } ``` You also need to define a new subsection for the Customer Account that is used in the above services: ```php <?php declare(strict_types=1); namespace App\SectionResolver; use Sylius\Bundle\ShopBundle\SectionResolver\ShopSection; class ShopCustomerAccountSubSection extends ShopSection { } ``` References • Originally published at https://huntr.dev/ For more information If you have any questions or comments about this advisory: • Open an issue in Sylius issues • Email us at [email protected]