Mittel

Sensitive Information Exposure in Sylius

Veröffentlicht: 14.03.2022
Aktualisiert: 11.10.2026 10:22

Impact

Any other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will block further reads. It may, however, lead to a data leak, like for example customer details, payment gateway configuration, etc.- but only if these were pages checked by the administrator.

This vulnerability requires full access to the computer to take advantage of it.

Patches

The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2 and above.

Workarounds

The application must strictly redirect to the login page even when the browser back button is pressed. Another possibility is to set more strict cache policies for restricted content (like no-store). It can be achieved with the following class:

php

<?php

declare(strict_types=1);

namespace App\EventListener;

use App\SectionResolver\ShopCustomerAccountSubSection;
use Sylius\Bundle\AdminBundle\SectionResolver\AdminSection;
use Sylius\Bundle\CoreBundle\SectionResolver\SectionProviderInterface;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

final class CacheControlSubscriber implements EventSubscriberInterface
{
    /** @var SectionProviderInterface */
    private $sectionProvider;

    public function __construct(SectionProviderInterface $sectionProvider)
    {
        $this->sectionProvider = $sectionProvider;
    }

    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::RESPONSE => 'setCacheControlDirectives',
        ];
    }

    public function setCacheControlDirectives(ResponseEvent $event): void
    {
        if (
            !$this->sectionProvider->getSection() instanceof AdminSection &&
            !$this->sectionProvider->getSection() instanceof ShopCustomerAccountSubSection
        ) {
            return;
        }

        $response = $event->getResponse();

        $response->headers->addCacheControlDirective('no-cache', true);
        $response->headers->addCacheControlDirective('max-age', '0');
        $response->headers->addCacheControlDirective('must-revalidate', true);
        $response->headers->addCacheControlDirective('no-store', true);
    }
}

After that register service in the container:

yaml

services:
    App\EventListener\CacheControlSubscriber:
        arguments: ['@sylius.section_resolver.uri_based_section_resolver']
        tags:
            - { name: kernel.event_subscriber, event: kernel.response }

The code above requires changes in ShopUriBasedSectionResolver in order to work. To backport mentioned logic, you need to replace the Sylius\Bundle\ShopBundle\SectionResolver\ShopUriBasedSectionResolver class with:

php

<?php

declare(strict_types=1);

namespace App\SectionResolver;

use Sylius\Bundle\CoreBundle\SectionResolver\SectionInterface;
use Sylius\Bundle\CoreBundle\SectionResolver\UriBasedSectionResolverInterface;
use Sylius\Bundle\ShopBundle\SectionResolver\ShopSection;

final class ShopUriBasedSectionResolver implements UriBasedSectionResolverInterface
{
    /** @var string */
    private $shopCustomerAccountUri;

    public function __construct(string $shopCustomerAccountUri = 'account')
    {
        $this->shopCustomerAccountUri = $shopCustomerAccountUri;
    }

    public function getSection(string $uri): SectionInterface
    {
        if (str_contains($uri, $this->shopCustomerAccountUri)) {
            return new ShopCustomerAccountSubSection();
        }

        return new ShopSection();
    }
}

yaml

services:
    sylius.section_resolver.shop_uri_based_section_resolver:
        class: App\SectionResolver\ShopUriBasedSectionResolver
        tags:
            - { name: sylius.uri_based_section_resolver, priority: -10 }

You also need to define a new subsection for the Customer Account that is used in the above services:

php

<?php

declare(strict_types=1);

namespace App\SectionResolver;

use Sylius\Bundle\ShopBundle\SectionResolver\ShopSection;

class ShopCustomerAccountSubSection extends ShopSection
{
}

References

Originally published at https://huntr.dev/

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Composer-Paket	sylius/sylius	< 1.9.10, >= 1.10, < 1.10.11, >= 1.11, < 1.11.2	1.9.10, 1.10.11, 1.11.2

Verweise

CVSS-Wert 5/10

CVSS-Vektor: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Schwäche (CWE): CWE-200, CWE-213, CWE-668
Plattform: Composer
Paket: sylius/sylius
Veröffentlicht: 14.03.2022
Aktualisiert: 11.10.2026 10:22

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-7563-75j9-6h5p - CC BY 4.0

Schwachstellenhistorie: sylius/sylius

Alle veröffentlichten Schwachstellen dieses Pakets (Composer-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (23) im Archiv

Einträge insgesamt: 23
Erste → letzte: 12.2019 07.2026
Ohne Fix: 0
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Hoch 4
Mittel 17
Niedrig 2

Veröffentlichungen pro Jahr

2019: 1
2020: 3
2021: 1
2022: 4
2023: 0
2024: 4
2025: 0
2026: 10

11.03.2026

Sylius has a Promotion Usage Limit Bypass via Race Condition

Hoch · 8.2 CVE-2026-31824 < 1.9.12, >= 1.10.0, < 1.10.16, >= 1.11.0, < 1.11.17, >= 1.12.0, < 1.12.23, >= 1.13.0, < 1.13.15, >= 1.14.0, < 1.14.18, >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3
11.03.2026

Sylius affected by IDOR in Cart and Checkout LiveComponents

Hoch CVE-2026-31820 >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 2.0.16, 2.1.12, 2.2.3
17.07.2024

Sylius has a security vulnerability via adjustments API endpoint

Hoch · 7.5 CVE-2024-40633 >= 1.12.0-alpha.1, < 1.12.19, >= 1.13.0-alpha.1, < 1.13.4, < 1.9.12, >= 1.10.0-alpha.1, < 1.10.16, >= 1.11.0-alpha.1, < 1.11.17 1.12.19, 1.13.4, 1.9.12, 1.10.16, 1.11.17
14.03.2022

Insufficient Session Expiration in Sylius

Hoch · 7.1 CVE-2022-24743 >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.2 1.10.11, 1.11.2
14.03.2022

Sensitive Information Exposure in Sylius dieser Eintrag

Mittel · 5.0 CVE-2022-24742 < 1.9.10, >= 1.10, < 1.10.11, >= 1.11, < 1.11.2 1.9.10, 1.10.11, 1.11.2

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden