Impact

Through two of the API endpoints, it's possible to set the amount on a payment to any value. If stores are configured to do so, this could lead to fulfilling orders without having collected sufficient funds.

Patches

The fix updates permitted attributes for all endpoints to only allow setting the amount for admins or when it explicitly set in a checkout controller. It is released in Solidus 4.6.3 and 4.7.1.

Workarounds

There are a few things that can be done to mitigate this issue should you not be able to update:

• Ensure Spree::Config[:require_payment_to_ship] is true to prevent shipping unpaid orders.
• Modify Spree::PermittedAttributes.payment_attributes to exclude :amount. Doing so will prevent the amount from being set in all endpoints. A subsequent monkey-patch would be required to allow it for Spree::Api::CheckoutsController and the storefront CheckoutsController because they need to allow the amount parameter through after they explicitly set it.

Credits

Rasul Rasulzada