GHSA-f8cm-364f-q9qh Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

• RubyGems spree: < 3.7.11 → fixed in 3.7.11 • RubyGems spree: >= 4.0.0, < 4.0.4 → fixed in 4.0.4 • RubyGems spree: >= 4.1.0, < 4.1.11 → fixed in 4.1.11

Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Workarounds In your project directory create a decorator file `app/controllers/spree/api/v2/base_controller_decotatror.rb` with contents: ```ruby module Spree module Api module V2 module BaseControllerDecorator private def spree_current_user return nil unless doorkeeper_token return @spree_current_user if @spree_current_user doorkeeper_authorize! @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id) end end end end Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator) ``` For more information If you have any questions or comments about this advisory: • Email us at [email protected]