CVE-2024-42355: Server Side Template Injection in Shopware using deprecation silence tag
Summary
CVE-2024-42355: Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag. Affects shopware/core across 2 version ranges.
< 6.5.8.13
>= 6.6.0.0, < 6.6.5.1
Fixed in 6.5.8.13 or 6.6.5.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that provides a range of features for online stores. It utilizes the Twig template engine for rendering templates. Twig is a flexible and secure template engine for PHP. However, a vulnerability has been discovered in Shopware that allows for Server Side Template Injection (SSTI) when using the deprecation silence tag in Twig templates.
Vulnerability Detail
The vulnerability in Shopware arises from a new Twig tag called sw_silent_feature_call, which is used to silence deprecation messages. This tag accepts a string parameter that represents the feature flag name to silence. However, the parameter is not properly escaped, allowing for code execution. An attacker can exploit this vulnerability by injecting malicious code into the parameter, leading to potential remote code execution and other security risks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.5.8.136.5.8.13composer require shopware/core:6.5.8.13 -
>= 6.6.0.0, < 6.6.5.16.6.5.1composer require shopware/core:6.6.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For older versions of Shopware (6.2, 6.3, and 6.4), a plugin is available that provides corresponding security measures. However, it is recommended to update to the latest version of Shopware to access the full range of functions and ensure comprehensive security.
Conclusion
Shopware is vulnerable to Server Side Template Injection when using the deprecation silence tag in Twig templates. This vulnerability can be mitigated by updating to the recommended versions or using the available plugin for older versions. It is crucial to keep the system up to date to ensure comprehensive security.
See every vulnerability recorded for shopware/core →
FAQ
Shopware is an open-source e-commerce platform that offers a wide range of features for online stores.
Twig is a flexible and secure template engine for PHP, used by Shopware for rendering templates.
Server Side Template Injection is a vulnerability that allows an attacker to inject and execute malicious code within server-side templates.
The vulnerability in Shopware allows for potential remote code execution and other security risks, depending on the injected code.
To fix this vulnerability, update Shopware to version 6.6.5.1 or 6.5.8.13, which include patches for the SSTI vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
