Cross-Site Request Forgery (CSRF) in gem/solidus_api
Cross-Site Request Forgery (CSRF)
solidus_frontend is the cart and storefront for the Solidus e-commerce project. Versions of solidus_frontend contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.
All versions before 2.11.14, all versions starting from 3.0.0 before 3.0.5, all versions starting from 3.1.0 before 3.1.5
Upgrade to versions 2.11.14, 3.0.5, 3.1.5 or above.