Description
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Spreecommerce Spreecommerce
Default version status: unaffected
0 to < 0.50.*affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_searchlogic_exec.rb ↗
- https://www.exploit-db.com/exploits/17199 ↗
- https://web.archive.org/web/20111120023342/http://spreecommerce.com/blog/2011/04/19/security-fixes ↗
- https://github.com/spree ↗
- https://www.vulncheck.com/advisories/spreecommerce-api-rce ↗