GHSA-93cw-f5jj-x85w: Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views

Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views

Critical severity GitHub Reviewed Published Jan 17, 2023 in shopware/platform • Updated Jan 18, 2023

Package

composer shopware/core (Composer)

Affected versions

<= 6.4.18.0

Patched versions

6.4.18.1

composer shopware/platform (Composer)

<= 6.4.18.0

6.4.18.1

Description

Impact

In Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like map, filter, sort. This allows in the template to call any global PHP function.

Patches

The problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished.

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates

References

• GHSA-93cw-f5jj-x85w
• shopware/platform@89d1ea1
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
• https://nvd.nist.gov/vuln/detail/CVE-2023-22731

shyim published the maintainer security advisory

Jan 17, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

CVE ID

CVE-2023-22731

GHSA ID

GHSA-93cw-f5jj-x85w

Source code

shopware/platform

Checking history

See something to contribute? Suggest improvements for this vulnerability.