Ability to expose data in Sylius by using an unintended serialisation group

Vulnerability

Description Sylius ResourceBundle automatically uses serialization groups provided via an HTTP header, without validating that the requested group is intended for the current API context. This flaw allows an attacker to specify arbitrary serialization groups, including those reserved for privileged interfaces like the Admin API, thereby exposing data meant to be restricted [1][4].

Exploitation

An attacker can craft a request to a ResourceBundle-based API endpoint and include a custom X-Serialization-Groups header (or similar) pointing to a more permissive group. For example, the Shop API endpoint could be made to use a group from the Admin API, bypassing intended access controls [1]. No authentication is required if the endpoint is publicly accessible; the attack only requires the ability to send HTTP requests with custom headers.

Impact

Successful exploitation leads to unauthorized exposure of sensitive data that should only be visible to administrators or specific user roles. This could include customer details, order information, or internal configuration, depending on the serialization groups defined in the application. The vulnerability affects all versions of Sylius ResourceBundle before 1.3.13, 1.4.6, 1.5.1, and 1.6.3 [4].

Mitigation

The vulnerability is patched in Sylius ResourceBundle versions 1.3.13, 1.4.6, 1.5.1, and 1.6.3. After applying the patch, only groups defined in serialization_groups or allowed_serialization_groups route configuration will be accepted, rejecting any undefined groups. For users who cannot upgrade immediately, a workaround involves overriding the sylius.resource_controller.request_configuration_factory service to remove custom serialization group handling [4].