Reflective XSS Vulnerability in Shopware Packages: High Security Risk Identified
Summary
GHSA-9v82-vcjx-m76j: Shopware: Reflective Cross Site-Scripting (XSS) in CMS components. Affects shopware/shopware versions >= 6.7.0.0, < 6.7.2.1. Fixed in 6.7.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and customizable templates. However, certain versions of Shopware, specifically versions 6.7.0.0 to 6.7.2.0, have been found to contain vulnerabilities that expose users to Cross-Site Scripting (XSS) attacks, allowing malicious actors to execute harmful scripts in the context of the user's session.
Vulnerability Detail
The vulnerability arises from inadequate input validation in the Shopware application, specifically in the JavaScript variable 'activeRouteParameters'. This lack of validation allows attackers to inject malicious JavaScript code into application pages, which is executed in the user's web browser when they visit the affected pages. The potential ramifications include theft of user session tokens and unauthorized administrative actions, posing a significant security risk. The vulnerability is classified as Reflective XSS, where the malicious code is executed every time the user visits a specific URL containing the payload.
How To Fix
Minimum fixed version
6.7.2.1
This is the first release that contains the fix.
composer require shopware/shopware:6.7.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to update immediately, a temporary workaround is to implement input validation measures via a plugin that can filter out malicious HTML and JavaScript characters. This can help mitigate the risk until the application is updated to the latest version.
Conclusion
The reflective XSS vulnerability in Shopware packages poses a serious security risk, allowing attackers to execute harmful scripts in the context of the user's session. Users are strongly advised to update to the patched version 6.7.2.1 to mitigate this risk. Additionally, implementing input validation measures can serve as a temporary workaround until the update is completed.
See every vulnerability recorded for shopware/shopware →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and actions.
You can check your application against the vulnerability using Vulert's playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
Consequences can include session hijacking, unauthorized actions performed on behalf of the user, and theft of sensitive information such as session tokens.
Using older versions that are known to have vulnerabilities poses a significant security risk. It is recommended to update to the latest patched version.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/shopware.
