PT-2024-29893 · Shopware · Shopware

Pweyck · Published 2024-08-08 · Updated 2025-04-15 · CVE-2024-42357

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.5.1 Shopware versions prior to 6.5.8.13

Description The Shopware application API contains a search functionality that enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the aggregations object. The name field in this aggregations object is vulnerable to SQL-injection and can be exploited using SQL parameters.

Recommendations Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. As a temporary workaround, consider restricting access to the aggregations object until a patch is available. Avoid using the name field in the aggregations object until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-42357

GHSA-P6W9-R443-R752

Affected Products

Shopware

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42357.json · Exploit
• https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac · Patch
• https://github.com/shopware/shopware/security/advisories/GHSA-p6w9-r443-r752 · Vendor Advisory
• https://github.com/shopware/shopware/commit/57ea2f3c59483cf7c0f853e7a0d68c23ded1fe5b · Patch
• https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f · Patch
• https://github.com/shopware/core/commit/63c05615694790f5790a04ef889f42b764fa53c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-42357 · Security Note
• https://osv.dev/vulnerability/GHSA-p6w9-r443-r752 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42357 · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://t.me/cvedetector/2792 · Telegram Post
• https://t.me/secharvester/18681 · Telegram Post
• https://t.me/cvedetector/23032 · Telegram Post
• https://twitter.com/cracbot/status/1823238125679939681 · Twitter Post
• https://t.me/cvenotify/90112 · Telegram Post