RCE in Shopware
CVE-2024-42356
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.006 (49.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Shopware — versions <= 6.5.8.12, >= 6.6.0.0, <= 6.6.5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj (Vendor Advisory)
- github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038 (Patch)
- github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f (Patch)
- github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac (Patch)
- github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e (Patch)
Frequently asked questions
- What is CVE-2024-42356?
- CVE-2024-42356 is a high-severity vulnerability in Shopware, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 8.3/10. Published 2024-08-08.
- How severe is CVE-2024-42356?
- High severity. CVSS v3 base score is 8.3 out of 10.
- Is CVE-2024-42356 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.