Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sylius | Sylius | 2.0.0 – < 2.1.16, 2.2.0 – < 2.2.9 | 2.1.16 |
References
- GitHub Security Advisory (GHSA-vv4h-q2x8-74g4) vendor-advisory
- https://github.com/Sylius/Sylius/pull/19216 patch issue-tracking
- https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d patch
- Sylius v2.2.9 Release Notes release-notes
- https://github.com/Sylius/Sylius product
- VulnCheck Advisory: Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite third-party-advisory