Shopware Document Retrieval Vulnerability: Broken ACL Allows Unauthorized Access
Summary
GHSA-68wv-g3fw-pq7q: Shopware Broken ACL on Document retrieval to access other customers documents. Affects shopware/core across 3 version ranges.
< 6.5.8.17
>= 6.6.0.0, < 6.6.10.3
>= 6.7.0.0-rc1, < 6.7.0.0-rc2
Fixed in 6.5.8.17, 6.6.10.3 or 6.7.0.0-rc2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is a popular open-source e-commerce platform that enables users to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, a vulnerability has been identified in its document retrieval system, which could allow unauthorized access to documents belonging to other customers.
Vulnerability Detail
The vulnerability arises from a broken Access Control List (ACL) in Shopware's document retrieval feature. This flaw allows an attacker to guess the deepLinkCode of a document, potentially granting them access to sensitive documents belonging to other customers. The implications of this vulnerability are significant, as it could lead to unauthorized data exposure and privacy violations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.5.8.176.5.8.17composer require shopware/core:6.5.8.17 -
>= 6.6.0.0, < 6.6.10.36.6.10.3composer require shopware/core:6.6.10.3 -
>= 6.7.0.0-rc1, < 6.7.0.0-rc26.7.0.0-rc2composer require shopware/core:6.7.0.0-rc2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users on older versions of Shopware 6.4, a plugin is available that implements corresponding security measures. It is recommended to install this plugin until an update to the latest version can be performed.
Conclusion
The identified vulnerability in Shopware's document retrieval system poses a risk of unauthorized access to customer documents. It is crucial for users to update to the latest patched versions or implement available workarounds to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your application.
See every vulnerability recorded for shopware/core →
FAQ
The vulnerability is a broken ACL that allows unauthorized access to documents of other customers through guessable deepLinkCodes.
Versions starting from 6.6.0.0 are affected, with specific fixes available in versions 6.6.10.3 and 6.5.8.17.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 4.0, indicating a moderate severity level.
If immediate updating is not possible, consider using the available plugin for older versions to implement security measures until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
