CVE-2011-10026

The vulnerability results from improper sanitization of the search[instance_eval] parameter passed to the API search function. The value of this parameter is dynamically invoked using Ruby's send method, which allows command injection and execution of arbitrary system shell commands. This mechanism requires no authentication, making the exploit available to any remote attacker.

An unauthenticated attacker can execute arbitrary system commands on the server hosting the application, which in practice means the possibility of complete server takeover, data theft, and further movement within the internal network (lateral movement).

Spreecommerce Spree should be updated to version 0.50.x or newer. Detailed information about security patches is available in the vendor's announcement at the address indicated in the references (spreecommerce.com/blog/2011/04/19/security-fixes).

Spreecommerce Spree in all versions preceding 0.50.x