Spreecommerce Remote Command Execution Vulnerability in Search Functionality

A remote command execution vulnerability has been identified in Spreecommerce versions prior to 0.60.2. The issue arises in the search feature, where the application does not adequately sanitize input from the search[send][] parameter. This unsanitized input is processed using Ruby's send method, enabling attackers to execute arbitrary shell commands on the server without authentication.

Impact

Exploitation of this vulnerability allows for unauthenticated remote command execution on the server.

Reproduction

The vulnerability can be reproduced by sending a GET request to the Spreecommerce application with a crafted search[send][] parameter. The payload should be URL-encoded and can include any command that the server's user has permission to execute. The command is executed in the context of the application's process, which may have limited privileges depending on the server configuration.

Remediation

Users are advised to upgrade to Spreecommerce version 0.60.2 or later, where this vulnerability has been fixed.