GHSA-2w46-vq8h-98vh
Shopware 6's password recovery link does not expire after email change
- Severity
- 5.0 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
- Fix
6.6.10.9- Upgrade shopware/core to this version or later
Description
Summary
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.
PoC
- Log in to a Shopware account.
- Request a password reset for your current email address.
- Copy the password reset link but do not open it.
- Log back into your account.n
- Navigate to Account Settings → Email and change your email address.
- Use the previously copied reset link (from before the email change).
- The system allows password change using the old link.
Impact
Reproduced on Stable 6.6.10.7 and trunk.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| shopware/core | < 6.6.10.9 |
6.6.10.9 |
| shopware/core | >= 6.7.0.0, < 6.7.4.1 |
6.7.4.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
shopware/core Packagist → 6.6.10.9
- composer
composer require shopware/core:^6.6.10.9
Severity breakdown
CVSS 3.1 5.0
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Weakness
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
How to prevent it
- Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Architecture and Design: Do not use standard weak security questions and use several security questions.
- Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
- Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
- Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
- Architecture and Design: Assign a new temporary password rather than revealing the original password.
References
Packages
Other links
- github.com/shopware/shopware/security/advisories/GHSA-2w46-vq8h-98vh
- github.com/shopware/shopware/commit/1338dd9a11e361639704bf8f09b6878552eb8c13
- github.com/shopware/shopware/commit/2fb94855696a90045b81c503d216ba7df8e64e52
- github.com/shopware/shopware/releases/tag/v6.6.10.9
- github.com/shopware/shopware/releases/tag/v6.7.0.0
- github.com/shopware/shopware/releases/tag/v6.7.4.1
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-gq96-5pfx-f4vc Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | Medium | Also affects shopware/core |
| GHSA-xvhc-gm7j-mhmc Shopware: Stored XSS via SVG file upload — no SVG sanitization | Medium | Also affects shopware/core |
| GHSA-9v5m-39wh-5chq Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | Medium | Also affects shopware/core |
| GHSA-f8q6-3g5w-jjr6 Shopware: Admin API ACL Bypass in Order State Transition Endpoints | Medium | Also affects shopware/core |
| GHSA-4x3x-869w-xx3m Shopware SSO referer trust leading to an arbitrary redirect target | Medium | Also affects shopware/core |
| GHSA-7w52-7jvm-m9vw Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | Low | Also affects shopware/core |
| GHSA-v39m-97p8-gqg7 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts | Medium | Also affects shopware/core |
| GHSA-8v9p-g828-v98f Shopware: Admin Account Takeover via User Recovery Hash Exposure | Medium | Also affects shopware/core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor