We got you covered, as long as you have your application up-to-date.

Although perfection is unattainable, our commitment to excellence remains unwavering. Announcing security updates is not something any technology favors, yet every software comes with its weaknesses and vulnerabilities. We take every security issue seriously and are dedicated to providing the best protection for our users. Today, we release important security fixes for Sylius versions 1.12 and 1.13.

Sylius 1.12 and above

Is my store affected by this vulnerability?

This issue is present in all Sylius versions before 1.12.19 and 1.13.4. This only affects the base API endpoints provided by Sylius.

Impact

A security vulnerability was discovered in the /api/v2/shop/adjustments/{id} endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details – sensitive guest customer information.

Patches

The issue is fixed in versions: 1.12.19, 1.13.4 and above.

Workarounds

Using YAML configuration:

Create config/api_platform/Adjustment.yaml file:

gist.github.com/GSadee/891c0c616846e2820f2f66bb1f829e0b#file-adjustment-yaml

Or using XML configuration:

Copy the original configuration from vendor:

gist.github.com/GSadee/891c0c616846e2820f2f66bb1f829e0b#file-bash-sh

And change the shop_get operation in copied config/api_platform/Adjustment.xml file:

gist.github.com/GSadee/891c0c616846e2820f2f66bb1f829e0b#file-adjustment-xml