GHSA-wjmg-4cq5-m8hg Sylius is Missing Authorization in API v2 Add Item Endpoint

• Packagist sylius/sylius: >= 2.0.0, < 2.0.16 → fixed in 2.0.16 • Packagist sylius/sylius: >= 2.1.0, < 2.1.12 → fixed in 2.1.12 • Packagist sylius/sylius: >= 2.2.0, < 2.2.3 → fixed in 2.2.3

Impact The `POST /api/v2/shop/orders/{tokenValue}/items` endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart `tokenValue`. ``` POST /api/v2/shop/orders/{tokenValue}/items ``` Other mutation endpoints (PUT, PATCH, DELETE) are not affected. API Platform loads the Order entity through the state provider for these operations, which triggers `VisitorBasedExtension` and returns 404 for unauthorized users. An attacker who obtains a cart `tokenValue` can add arbitrary items to another customer's cart. The endpoint returns the full cart representation in the response (HTTP 201), potentially leaking: • Customer email address • Cart contents (products, quantities, prices) • Address data (billing and shipping if set) • Payment and shipment IDs • Order totals and tax breakdown • Checkout state Patches The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3, and above. Workarounds Add an ownership check in `AddItemToCartHandler` by injecting `UserContextInterface` and verifying the current user matches the cart owner before adding items. Step 1. Patch the handler Create new `src/CommandHandler/Cart/AddItemToCartHandler.php`: ```php productVariantRepository->findOneBy(['code' => $addItemToCart->productVariantCode]); if ($productVariant === null) { throw new \InvalidArgumentException('Product variant with given code has not been found.'); } /** @var OrderInterface|null $cart */ $cart = $this->orderRepository->findCartByTokenValue($addItemToCart->orderTokenValue); if ($cart === null) { throw new \InvalidArgumentException('Cart with given token has not been found.'); } $this->assertCartAccessible($cart); /** @var OrderItemInterface $cartItem */ $cartItem = $this->cartItemFactory->createNew(); $cartItem->setVariant($productVariant); $this->orderItemQuantityModifier->modify($cartItem, $addItemToCart->quantity); $this->orderModifier->addToOrder($cart, $cartItem); return $cart; } private function assertCartAccessible(OrderInterface $cart): void { if ($cart->isCreatedByGuest()) { return; } $cartCustomer = $cart->getCustomer(); if (null === $cartCustomer || null === $cartCustomer->getUser()) { return; } $currentUser = $this->userContext->getUser(); if ( $currentUser instanceof ShopUserInterface && $currentUser->getCustomer()?->getId() === $cartCustomer->getId() ) { return; } throw new NotFoundHttpException('Cart not found.'); } } ``` Step 2. Override the service ```diff config/services.yaml services: App\: resource: '../src/*' • exclude: '../src/{Entity,Kernel.php}' + exclude: '../src/{Entity,Kernel.php,CommandHandler}' sylius_api.command_handler.cart.add_item_to_cart: class: App\CommandHandler\Cart\AddItemToCartHandler arguments: $orderRepository: '@sylius.repository.order' $productVariantRepository: '@sylius.repository.product_variant' $orderModifier: '@sylius.modifier.order' $cartItemFactory: '@sylius.factory.order_item' $orderItemQuantityModifier: '@sylius.modifier.order_item_quantity' $userContext: '@Sylius\Bundle\ApiBundle\Context\UserContextInterface' tags: • { name: messenger.message_handler, bus: sylius.command_bus } ``` Step 3. Clear cache ```bash bin/console cache:clear ``` Reporters We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability: • @rokorolov For more information If you have any questions or comments about this advisory: • Open an issue in Sylius issues • Email us at [email protected]