Kestrel
대시보드로 돌아가기
CVE-2026-53637MEDIUM· 6.5GHSA대응게시일: 2026. 07. 09.수정일: 2026. 07. 09.

Sylius: Cart FormComponent allows modification or deletion of an already-completed order

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음
CVSS
6.5medium

이론적 심각도 점수

EPSS
—

예측 데이터 없음

KEV
미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로
공격 벡터네트워크
공격 복잡도낮음
필요 권한낮음
사용자 상호작용불필요
범위불변
영향
기밀성 영향없음
무결성 영향높음
가용성 영향없음
버전별 점수
CVSS 3.16.5MODERATE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

상세 설명

Impact

A user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes the status, or the user finalizes payment in another tab. The browser still displays the old cart: the LiveComponent is unaware the underlying order state has changed.

If the user then:

  • clears the cart → clearCart() calls manager->remove() on the
    completed order: the order is permanently deleted from the database;
  • removes a product → removeItem() mutates an item on the completed
    order;
  • changes quantity → saveCart() overwrites data on the completed order.

In all cases, the customer's order data is irreversibly corrupted or lost, even though the order has already been placed and paid for. The same vector can be triggered deliberately by an authenticated customer (keep the cart page open, complete checkout in another tab, then modify the "cart" to add quantity beyond what was paid for).

Patches

The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above.

Workarounds

If users cannot update Sylius immediately, they should create a patched copy of the affected class in their application's src/ directory and override the Sylius service definition to use it.

Step 1. Create src/Twig/Component/Cart/FormComponent.php
bash
 1<?php
 2 
 3declare(strict_types=1);
 4 
 5namespace App\Twig\Component\Cart;
 6 
 7use Doctrine\Persistence\ObjectManager;
 8use Sylius\Bundle\UiBundle\Twig\Component\ResourceFormComponentTrait;
 9use Sylius\Bundle\UiBundle\Twig\Component\TemplatePropTrait;
10use Sylius\Component\Core\Model\OrderInterface;
11use Sylius\Component\Core\OrderCheckoutStates;
12use Sylius\Component\Core\Repository\OrderRepositoryInterface;
13use Sylius\Component\Order\SyliusCartEvents;
14use Sylius\Resource\Model\ResourceInterface;
15use Symfony\Component\EventDispatcher\EventDispatcherInterface;
16use Symfony\Component\EventDispatcher\GenericEvent;
17use Symfony\Component\Form\FormFactoryInterface;
18use Symfony\UX\LiveComponent\Attribute\LiveAction;
19use Symfony\UX\LiveComponent\Attribute\LiveArg;
20use Symfony\UX\LiveComponent\Attribute\PreReRender;
21use Symfony\UX\LiveComponent\ComponentToolsTrait;
22 
23class FormComponent
24{
25    use ComponentToolsTrait;
26 
27    /** @use ResourceFormComponentTrait<OrderInterface> */
28    use ResourceFormComponentTrait;
29 
30    use TemplatePropTrait;
31 
32    public const SYLIUS_SHOP_CART_CHANGED = 'sylius:shop:cart_changed';
33 
34    public const SYLIUS_SHOP_CART_CLEARED = 'sylius:shop:cart_cleared';
35 
36    public bool $shouldSaveCart = true;
37 
38    /** @param OrderRepositoryInterface<OrderInterface> $orderRepository */
39    public function __construct(
40        OrderRepositoryInterface $orderRepository,
41        FormFactoryInterface $formFactory,
42        string $resourceClass,
43        string $formClass,
44        protected readonly ObjectManager $manager,
45        protected readonly EventDispatcherInterface $eventDispatcher,
46    ) {
47        $this->initialize($orderRepository, $formFactory, $resourceClass, $formClass);
48    }
49 
50    public function hydrateResource(mixed $value): ?ResourceInterface
51    {
52        if (empty($value)) {
53            return $this->createResource();
54        }
55 
56        /** @var OrderInterface|null $order */
57        $order = $this->repository->find($value);
58 
59        if (
60            !$order instanceof OrderInterface
61            || $order->getCheckoutState() === OrderCheckoutStates::STATE_COMPLETED
62        ) {
63            return $this->createResource();
64        }
65 
66        return $order;
67    }
68 
69    #[PreReRender(priority: -100)]
70    public function saveCart(): void
71    {
72        if ($this->shouldSaveCart && $this->resource?->getId() !== null) {
73            $form = $this->getForm();
74            if ($form->isValid()) {
75                $this->eventDispatcher->dispatch(new GenericEvent($form->getData()), SyliusCartEvents::CART_CHANGE);
76                $this->manager->flush();
77                $this->emit(self::SYLIUS_SHOP_CART_CHANGED, ['cartId' => $this->resource->getId()]);
78            }
79        }
80    }
81 
82    #[LiveAction]
83    public function removeItem(#[LiveArg] int $index): void
84    {
85        if ($this->resource?->getId() === null) {
86            return;
87        }
88 
89        $data = $this->formValues['items'];
90        unset($data[$index]);
91        $this->formValues['items'] = array_values($data);
92 
93        $orderItem = $this->resource->getItems()->get($index);
94        $this->eventDispatcher->dispatch(new GenericEvent($orderItem), SyliusCartEvents::CART_ITEM_REMOVE);
95 
96        $this->manager->persist($this->resource);
97        $this->manager->flush();
98        $this->manager->refresh($this->resource);
99 
100        $this->shouldSaveCart = false;
101        $this->submitForm();
102        $this->emit(self::SYLIUS_SHOP_CART_CHANGED, ['cartId' => $this->resource->getId()]);
103    }
104 
105    #[LiveAction]
106    public function clearCart(): void
107    {
108        if ($this->resource?->getId() === null) {
109            return;
110        }
111 
112        $this->formValues['items'] = [];
113        $this->eventDispatcher->dispatch(new GenericEvent($this->resource), SyliusCartEvents::CART_CLEAR);
114        $this->manager->remove($this->resource);
115        $this->manager->flush();
116 
117        $this->resource = $this->createResource();
118        $this->resetForm();
119        $this->isValidated = false;
120        $this->validatedFields = [];
121 
122        $this->shouldSaveCart = false;
123        $this->submitForm();
124        $this->emit(self::SYLIUS_SHOP_CART_CLEARED);
125    }
126 
127    #[LiveAction]
128    public function removeCoupon(): void
129    {
130        $this->formValues['promotionCoupon'] = '';
131 
132        $this->submitForm();
133    }
134 
135    private function getDataModelValue(): string
136    {
137        return 'debounce(500)|*';
138    }
139}
Step 2. Override the Sylius service in config/services.yaml

Append to the application's config/services.yaml (or a dedicated file loaded by the kernel, e.g. config/packages/sylius_security_cart.yaml):

text
 1services:
 2    sylius_shop.twig.component.cart.form:
 3        class: App\Twig\Component\Cart\FormComponent
 4        arguments:
 5            - '@sylius.repository.order'
 6            - '@form.factory'
 7            - '%sylius.model.order.class%'
 8            - 'Sylius\Bundle\ShopBundle\Form\Type\CartType'
 9            - '@doctrine.orm.entity_manager'
10            - '@event_dispatcher'
11        calls:
12            - [setLiveResponder, ['@ux.live_component.live_responder']]
13        tags:
14            - { name: sylius.live_component.shop, key: 'sylius_shop:cart:form' }

This redeclares the existing Sylius service id sylius_shop.twig.component.cart.form so it instantiates the patched class from App\ while preserving every argument, call and tag from the original Sylius XML definition. The cart twig hook keeps resolving to the same Live Component key (sylius_shop:cart:form).

Step 3. Clear the cache
text
 1bin/console cache:clear

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:

  • Kévin Gonella (@kgonella)
  • Sam V.

For more information

If there are any questions or comments about this advisory:

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 2

링크 내용 불러오는 중…