Summary

Using Pickup: Local stock only as a click-and-collect points could cause a leak of customer addresses

Details

When using Pickup: Local stock only click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address.

Impact

The vulnerability can cause the leak of customer's address when using click-and-collect delivery option marked as Local stock only. It has impact on all orders with click-and-collect delivery method marked as Pickup:Local stock only
The affected versions: >=3.14.56 <3.14.61, >=3.15.31 <3.15.37, >=3.16.27 <3.16.34, >=3.17.25 <3.17.32, >=3.18.19 <3.18.28, >=3.19.5 <3.19.15
This issue has been patched in versions: 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, 3.19.15

Workaround

We strongly recommend upgrading to the latest versions, in case of inability to upgrade straight away, possible workarounds are:

• turn off click-and-collect delivery method on warehouse view when Pickup option is set to Local stock only.
• cherry-pick the changes from PRs: saleor/saleor#15694 & saleor/saleor#15697

References

• Commits introducing the issue (saleor/saleor@22a1aa3 main, saleor/saleor@997f7ea 3.14, saleor/saleor@ef003c7 3.15, saleor/saleor@39abb0f 3.16, saleor/saleor@b7cecda 3.17, saleor/saleor@dccc2c8 3.18, saleor/saleor@d8ba545 3.19)
• saleor/saleor@47cedfd (main branch)
  https://github.com/saleor/saleor/releases/tag/3.14.60
  https://github.com/saleor/saleor/releases/tag/3.14.61
  https://github.com/saleor/saleor/releases/tag/3.15.36
  https://github.com/saleor/saleor/releases/tag/3.15.37
  https://github.com/saleor/saleor/releases/tag/3.16.33
  https://github.com/saleor/saleor/releases/tag/3.16.34
  https://github.com/saleor/saleor/releases/tag/3.17.31
  https://github.com/saleor/saleor/releases/tag/3.17.32
  https://github.com/saleor/saleor/releases/tag/3.18.27
  https://github.com/saleor/saleor/releases/tag/3.18.28
  https://github.com/saleor/saleor/releases/tag/3.19.14
  https://github.com/saleor/saleor/releases/tag/3.19.15

References

• GHSA-mrj3-f2h4-7w45
• https://nvd.nist.gov/vuln/detail/CVE-2024-29888
• saleor/saleor#15697
• saleor/saleor#15694
• saleor/saleor@b7cecda
• saleor/saleor@d8ba545
• saleor/saleor@dccc2c8
• saleor/saleor@ef003c7
• saleor/saleor@997f7ea
• saleor/saleor@47cedfd
• saleor/saleor@39abb0f
• saleor/saleor@22a1aa3
• https://github.com/saleor/saleor/releases/tag/3.14.61
• https://github.com/saleor/saleor/releases/tag/3.15.37
• https://github.com/saleor/saleor/releases/tag/3.16.34
• https://github.com/saleor/saleor/releases/tag/3.17.32
• https://github.com/saleor/saleor/releases/tag/3.18.28
• https://github.com/saleor/saleor/releases/tag/3.19.15