Drupal Commerce Core has an actively exploited access-bypass flaw, and the advisory tells merchants to audit their orders too

Drupal's advisory for Commerce Core gives a merchant two jobs. The first is the usual one: update. The second is unusual: open your orders and look for inconsistencies, because, the advisory says, the flaw is already being exploited.

The hole is in the shop, not in the site around it. Commerce Core is a Drupal module for selling goods and services through a shopping cart and checkout, and the advisory says the gap may financially impact the merchant. The cause it gives: the module does not sufficiently protect certain routes and entity fields.

How many stores were hit, since when the attack has been running and what exactly changes in the orders, the advisory does not say. It does not say who is attacking either. It lists no signs to search for, only the task of reviewing your orders.

The patch is for going forward.

So updating is half the job. The other half is bookkeeping. Here is where I would start: compare the orders with your payment provider's report and look for differences. The advisory does not spell that out; this is my own logic.

The same day Drupal released more advisories for Commerce Core, Commerce Stripe, Commerce Shipping and Commerce License. Of these, in the list on drupal.org only this one is marked as exploited.

Update to 3.3.13, or to 8.x-2.41 if you are on the older line, and then open the orders. How far back to look, the advisory does not say, so go back as far as your data reaches.

The visual is generated code-art, no third-party images.