Project
Simple Package Tracking
Date
Severity
Moderately Critical
Risk Score
13/25 AC:Basic/A:User/CI:None/II:Some/E:Exploit/TD:Default
Vulnerability
Access Bypass
Affected versions
<7.x-1.4

Description

The Simple Package Tracking module provides a simplified interface for attaching shipment tracking numbers to Drupal Commerce orders.

The module registered four AJAX menu callbacks: delete, delete-confirm, action, and action-confirm. Because the `access content` permission is granted to virtually all authenticated users, these endpoints performed no ownership or order-level permission check, allowing any authenticated user to delete or re-trigger tracking actions on tracking numbers from arbitrary orders by supplying a different `order_id` in the URL.

This vulnerability is mitigated by the fact that exploitation requires an authenticated session and knowledge (or enumeration) of a valid order ID and tracking number ID belonging to another user.

Solution

Install the latest version.

If you use the Simple Package Tracking module for Drupal 7, upgrade to simple_package_tracking 7.x-1.4:

Reported by

Fixed by

  • Tag1 D7ES

Coordinated by

  • Tag1 D7ES