CVE-2022-39275 (published 2022-10-06T18:16Z)

Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/saleor/saleor
commit_details: repo_url: https://github.com/saleor/saleor
author: Mika
author_date: 2022-10-03 14:04:47+02:00
msg: Merge pull request from GHSA-xhq8-8c5v-w8ff

* Fix improper ID type validation

* Fix failing test cases

- `ProductVariantBulkCreate` mutation was not able to determine whether Product type ID was passed
- `ShippingPriceTranslate` mutation uses a QuerySet with ID type ShippingMethodType
repository: repo_url: https://github.com/saleor/saleor
repo_name: saleor/saleor
description: Saleor Core: the high performance, composable, headless commerce API.
repo_language: Python
owner: saleor
file_changes: filename: account.py
change_type: ModificationType.MODIFY
diff: @@ -388,7 +388,7 @@ class AccountSetDefaultAddress(BaseMutation):
 
     @classmethod
     def perform_mutation(cls, _root, info, **data):
-        address = cls.get_node_or_error(info, data.get("id"), Address)
+        address = cls.get_node_or_error(info, data.get("id"), only_type=Address)
         user = info.context.user
 
         if not user.addresses.filter(pk=address.pk).exists():

programming_language: Python
filename: base.py
change_type: ModificationType.MODIFY
diff: @@ -369,7 +369,7 @@ class BaseAddressDelete(ModelDeleteMutation):
             raise PermissionDenied()
 
         node_id = data.get("id")
-        instance = cls.get_node_or_error(info, node_id, Address)
+        instance = cls.get_node_or_error(info, node_id, only_type=Address)
         if instance:
             cls.clean_instance(info, instance)
 

programming_language: Python
filename: mutations.py
change_type: ModificationType.MODIFY
diff: @@ -514,7 +514,7 @@ class AssignNavigation(BaseMutation):
     def perform_mutation(cls, _root, info, navigation_type, menu=None):
         site = load_site(info.context)
         if menu is not None:
-            menu = cls.get_node_or_error(info, menu, field="menu")
+            menu = cls.get_node_or_error(info, menu, field="menu", only_type=Menu)
 
         if navigation_type == NavigationType.MAIN:
             site.settings.top_menu = menu

programming_language: Python
filename: products.py
change_type: ModificationType.MODIFY
diff: @@ -547,7 +547,7 @@ class ProductVariantBulkCreate(BaseMutation):
     @classmethod
     @traced_atomic_transaction()
     def perform_mutation(cls, _root, info, **data):
-        product = cls.get_node_or_error(info, data["product_id"], models.Product)
+        product = cls.get_node_or_error(info, data["product_id"], only_type="Product")
         errors = defaultdict(list)
 
         cleaned_inputs = cls.clean_variants(info, data["variants"], product, errors)

programming_language: Python