CVE-2024-31447: Shopware Improper Session Handling in store-api account logout
Summary
CVE-2024-31447: Shopware Improper Session Handling in store-api account logout. Affects shopware/core across 2 version ranges.
>= 6.3.5.0, < 6.5.8.8
>= 6.6.0.0-rc1, < 6.6.1.0
Fixed in 6.5.8.8 or 6.6.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that provides a range of features for online stores. It includes functionalities such as product management, order processing, customer management, and more. The vulnerability affects the store-api component of Shopware, specifically the account logout functionality.
Vulnerability Detail
The vulnerability arises when an authenticated request is made to the POST /store-api/account/logout endpoint. While the cart is cleared, the user is not properly logged out. This issue only impacts direct usage of the store-api and does not affect the PHP Storefront, which invalidates the session through the CustomerLogoutEvent. The vulnerability can potentially allow an attacker to maintain access to a user's account even after the logout request.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.3.5.0, < 6.5.8.86.5.8.8composer require shopware/core:6.5.8.8 -
>= 6.6.0.0-rc1, < 6.6.1.06.6.1.0composer require shopware/core:6.6.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately feasible, an alternative workaround is to install the latest version of the Shopware Security Plugin. This plugin can help mitigate the vulnerability until a full update can be performed.
Conclusion
The improper session handling vulnerability in the store-api account logout functionality of Shopware can potentially allow unauthorized access to user accounts. It is crucial to update to the latest patched versions of Shopware (6.6.1.0 or 6.5.8.8) to mitigate this vulnerability. If immediate updating is not possible, installing the Shopware Security Plugin can provide temporary protection. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for shopware/core →
FAQ
The vulnerability allows an attacker to maintain access to a user's account even after a logout request, potentially leading to unauthorized actions on the user's behalf.
The vulnerability affects Shopware versions 6.3.5.0 and above, up to versions 6.6.0.0-rc1. Versions 6.5.8.8 and 6.6.1.0 include the necessary fixes.
Yes, the vulnerability only affects the store-api component of Shopware. The PHP Storefront handles the logout functionality properly.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
