CVE-2024-22407: Broken Access Control in Shopware CMS
Summary
CVE-2024-22407: Broken Access Control order API in Shopware. Affects shopware/core versions < 6.5.7.4. Fixed in 6.5.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is a CMS (Content Management System) used for building and managing online stores. It provides various features for managing orders, payments, and delivery. The Shopware core and platform packages are the main components of the system. This vulnerability affects versions of Shopware up to 6.5.7.3. The vulnerability allows users without proper permissions to modify the payment, delivery, and order status of an order, bypassing access controls.
Vulnerability Detail
The state handler for orders in Shopware CMS does not adequately verify user authorizations for actions that modify the payment, delivery, and order status. This allows users without 'write' permissions for orders to change the order state. The inadequate implementation of access controls can lead to unauthorized modifications to orders, potentially resulting in financial loss, incorrect order processing, or other negative impacts on the system and its users.
How To Fix
Minimum fixed version
6.5.7.4
This is the first release that contains the fix.
composer require shopware/core:6.5.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For older versions of Shopware (6.1, 6.2, 6.3, and 6.4), a plugin is available to implement corresponding security measures. However, it is recommended to update to the latest version for the full range of functions and the most comprehensive security improvements.
Conclusion
The broken access control vulnerability in Shopware CMS allows unauthorized users to modify order states, potentially leading to financial loss or incorrect order processing. To mitigate this vulnerability, it is crucial to update to Shopware version 6.5.7.4 or later. Additionally, older versions can utilize a plugin for limited security measures. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shopware/core →
FAQ
Shopware CMS is a content management system specifically designed for building and managing online stores. It provides features for managing orders, payments, and delivery.
The vulnerability allows users without proper permissions to modify the payment, delivery, and order status of an order. This can lead to unauthorized changes to orders, potentially resulting in financial loss or incorrect order processing.
To fix this vulnerability, update your Shopware installation to version 6.5.7.4 or later. This update includes a patch that addresses the broken access control issue.
For older versions of Shopware (6.1, 6.2, 6.3, and 6.4), a plugin is available to implement corresponding security measures. However, updating to the latest version is recommended for the most comprehensive security improvements.
You can find more information about this vulnerability in the Shopware advisory on GitHub: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
