Spreecommerce < 0.60.2 Search Parameter RCE

Vulnerability

Spreecommerce versions prior to 0.60.2 contain a remote command execution vulnerability in the search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby's send method [1][2]. This allows arbitrary method calls on the underlying objects.

Exploitation

An attacker can exploit this by sending a crafted HTTP request to the search endpoint without authentication. The Metasploit module demonstrates a payload that uses Kernel.fork to execute shell commands [4]. The exploit requires no authentication and is accessible from the network.

Impact

Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary shell commands on the server, leading to full system compromise [2][4]. The vulnerability can be used to gain remote code execution, data exfiltration, or further lateral movement.

Mitigation

The vulnerability was patched in Spreecommerce version 0.60.2 [1][2]. Users running earlier versions should upgrade immediately. A Metasploit exploit module is publicly available, increasing the risk of active exploitation [4].