SA-CONTRIB-2012-060 - Commerce Reorder - Cross Site Request Forgery

CVE: CVE-2012-2116

The Commerce Reorder module enables you to reorder previously purchased products for Drupal Commerce.

The module does not sufficiently protect the re-order URL against Cross Site Request Forgery (CSRF), allowing a malicious user to trick someone into adding unwanted items to their shopping cart.

This vulnerability is mitigated by by the fact that while items can be placed in a shopping cart, the user still has to complete the checkout process, and by the fact that re-ordering is restricted by access to the “source” order.

Versions affected

• Commerce Reorder versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Commerce Reorder module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Commerce Reorder module, upgrade to Commerce Reorder 7.x-1.1

Also see the Commerce Reorder project page.

Reported by

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Fixed by

• Pedro Cambra (pcambra), the module maintainer
• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Coordinated by

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team