GitHub Security Advisory: GHSA-h3fg-h5v3-vf8m
Package: solidus_frontend (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2.11.14
Patched in: 2.11.14

Summary: CSRF forgery protection bypass in solidus_frontend

Details:
### Impact
CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge.

All `solidus_frontend` versions are affected. If you're using your own storefront, please, follow along to make sure you're not affected.

To reproduce the issue:

- Pick the id for a variant with available stock. From the rails console:

  ```ruby
  Spree::Variant.in_stock.pluck(:id)
  ```

  Say we pick variant id `2`.

- Launch your application, for instance, on `http://localhost:3000`:

  ```bash
  bin/rails server
  ```

- Open your browser dev tools.

- Click on whatever link in your store.

- Copy the value of the `Cookie` request header sent for the previous request from your browser dev tools.

- Execute the following, using your previously selected variant id and the value of the `Cookie` header (notice how it doesn't contain any authentication token):

  ```bash
  curl -X POST -d "variant_id=2&quantity=1" -H "Cookie: guest_token=eyJfcmFpbHMiOnsibWVzc2FnZSI6IklrWlRVMWRQWnpKMVZVdFNXRzlPVW1aaWJHTjZZa0VpIiwiZXhwIjpudWxsLCJwdXIiOiJjb29raWUuZ3Vlc3RfdG9rZW4ifX0%3D--5006ba5d346f621c760a29b6a797bf351d17d1b8; _sandbox_session=vhutu5%2FL9NmWrUpGc3DxrFA%2FFsQD1dHn1cNsD7nvE84zcjWf17Af4%2F%2F2Vab3md71b6KTb9NP6WktdXktpwH4eU01jEGIBXG5%2BMzW5nL0nb4W269qk1io4LYljvoOg8%2BZVll7oJCVkJLKKh0sSoS0Kg8j%2FCHHs%2BsShohP%2BGnA%2Bfr9Ub8H6HofpSmloSpsfHHygmX0ho03fEgzHJ4DD5wJctaNKwg7NhVikHh5kgIPPHl84OGCgv3p2oe9jR19HTxOKq7BtyvDd7XZsecWhkcfS8BPnvDDUWZG6qpAEFI5kWo81KkpSJ%2Bp6Q1HOo8%3D--n3G2vgaDG7VS%2B%2FhF--ZTjxBAkfGG3hpr4GRQ2S1Q%3D%3D; __profilin=p%3Dt" http://localhost:3000/orders/populate
  ```

- Reload your browser and look at how your cart got updated.

### Patches

Please, upgrade `solidus` to versions `3.1.5`, `3.0.5` or `2.11.14`.

After upgrading, make sure you read the "Upgrade notes"  section below.

### Upgrade notes

The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects.

#### `InvalidAuthenticityToken` errors

If you're using the `:exception` strategy, it's likely that after upgrading, you'll see more `ActionController::InvalidAuthenticityToken` errors popping out in your logs. Due to browser-side cache, a form can be re-rendered and sent without any attached request cookie (for instance, when re-opening a mobile browser). That will cause an authentication error, as the sent token won't match with the one in the session (none in this case). That's a known problem in the Rails community (see https://github.com/rails/rails/issues/21948), and, at this point, there's no perfect solution.

Any attempt to mitigate the issue should be seen at the application level. For an excellent survey of all the available options, take a look at https://github.com/betagouv/demarches-simplifiees.fr/blob/5b4f7f9ae9eaf0ac94008b62f7047e4714626cf9/doc/adr-csrf-forgery.md. The latter is a third-party link. As the information is relevant here, we're going to copy it below, b