Critical · published August 14, 2025
🔥 A sneaky flaw in Spreecommerce puts your server at risk with remote command execution! Just one unfiltered search input can let attackers run arbitrary commands without breaking a sweat. ⚡ Think of this like a poorly designed restaurant menu that allows diners to request anything from the kitchen, including secret recipes! If the chef doesn't double-check orders, anyone could sneak in and make off with the entire menu—yikes! An attacker could waltz right in and execute any command on your server, leaving your entire system open to chaos—data theft, total system compromise, you name it. This vulnerability effectively hands over the keys to your kingdom, making it a critical situation that can't be ignored!
Think of this like a poorly designed restaurant menu that allows diners to request anything from the kitchen, including secret recipes! If the chef doesn't double-check orders, anyone could sneak in and make off with the entire menu—yikes! This vulnerability arises because the search functionality improperly sanitizes the input from the search[send][] parameter. Through Ruby's `send` method, it allows attackers to run commands they shouldn't have access to, effectively bypassing any authentication checks.
An attacker could waltz right in and execute any command on your server, leaving your entire system open to chaos—data theft, total system compromise, you name it. This vulnerability effectively hands over the keys to your kingdom, making it a critical situation that can't be ignored! Upgrade to Spreecommerce version 0.60.2 or later to patch this critical vulnerability immediately. Additionally, review your input sanitization practices to ensure that no untrusted data is processed in a way that could lead to command execution. Do it now! You've got this! By following these steps, you'll secure your site and protect your data in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| spreecommerce/spree | < 0.60.2 | 0.60.2 |