CVE-2024-42356
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Impact
### Impact The `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: ```php $context->scope(Context::SYSTEM_SCOPE, static function (Context $context) use ($mediaService, $media, &$fileBlob): void { $fileBlob = $mediaService->loadFile($media->getId(), $context); }); ``` This function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. ### Patches Update to Shopware 6.6.5.1 or 6.5.8.13 ### Workarounds For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | shopware/core | <= 6.5.8.12 | 6.5.8.13 |
| composer | shopware/platform | <= 6.5.8.12 | 6.5.8.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Shopware | Shopware | before 6.5.8.13 from 6.6.0.0 before 6.6.5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
- https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
- https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
- https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
- https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
- https://github.com/advisories/GHSA-35jp-8cgg-p4wj
- https://nvd.nist.gov/vuln/detail/CVE-2024-42356