PT-2024-29892 · Shopware · Shopware

Creastery · Published 2024-08-08 · Updated 2024-08-15 · CVE-2024-42356

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.5.8.13 Shopware versions prior to 6.6.5.1

Description The issue concerns the context variable injected into almost any Twig Template, allowing access to current language and currency information. The context object can switch the scope of the Context as a helper with a callable function, which can be called from Twig. This allows calling any statically callable PHP function/method from Twig. Exploitation requires access to Administration, using Mail templates or App Scripts.

Recommendations Update to Shopware 6.5.8.13 to receive a patch. Update to Shopware 6.6.5.1 to receive a patch. For older versions of 6.1, 6.2, 6.3, and 6.4, corresponding security measures are available via a plugin.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-1336

Related Identifiers

CVE-2024-42356

GHSA-35JP-8CGG-P4WJ

Affected Products

Shopware

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42356.json · Exploit
• https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac · Patch
• https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e · Patch
• https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj · Vendor Advisory
• https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038 · Patch
• https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f · Patch
• https://osv.dev/vulnerability/CVE-2024-42356 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-35jp-8cgg-p4wj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42356 · Security Note
• https://github.com/shopware/shopware · Note
• https://twitter.com/cracbot/status/1823238124136550411 · Twitter Post
• https://twitter.com/oktsec/status/1824268411980972084 · Twitter Post
• https://t.me/cvedetector/2793 · Telegram Post
• https://t.me/cvenotify/90111 · Telegram Post