GHSA-pjj4-jjgc-h3r8
Authenticated remote code execution
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
6.3.5.2- Upgrade shopware/platform to this version or later
Description
Impact
Authenticated remote code execution using plugin manager without ACL permissions.
Patches
We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| shopware/platform | < 6.3.5.2 |
6.3.5.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
shopware/platform Packagist → 6.3.5.2
- composer
composer require shopware/platform:^6.3.5.2
Weakness
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-gq96-5pfx-f4vc Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | Medium | Also affects shopware/platform |
| GHSA-xvhc-gm7j-mhmc Shopware: Stored XSS via SVG file upload — no SVG sanitization | Medium | Also affects shopware/platform |
| GHSA-9v5m-39wh-5chq Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | Medium | Also affects shopware/platform |
| GHSA-f8q6-3g5w-jjr6 Shopware: Admin API ACL Bypass in Order State Transition Endpoints | Medium | Also affects shopware/platform |
| GHSA-4x3x-869w-xx3m Shopware SSO referer trust leading to an arbitrary redirect target | Medium | Also affects shopware/platform |
| GHSA-7w52-7jvm-m9vw Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | Low | Also affects shopware/platform |
| GHSA-v39m-97p8-gqg7 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts | Medium | Also affects shopware/platform |
| GHSA-8v9p-g828-v98f Shopware: Admin Account Takeover via User Recovery Hash Exposure | Medium | Also affects shopware/platform |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor