GitHub Advisoryadvisory · Packagist

GHSA-27wp-jvhw-v4xp Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

HIGH Published 2024-08-08 Modified 2024-08-08 Official page ↗
Aliases
CVE-2024-42355
Ecosystem
Packagist
Packages
shopware/core, shopware/platform
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-1336, CWE-94
Reviewed
2024-08-08

Affected packages

• Packagist shopware/core: < 6.5.8.13 → fixed in 6.5.8.13 • Packagist shopware/platform: < 6.5.8.13 → fixed in 6.5.8.13 • Packagist shopware/platform: >= 6.6.0.0, < 6.6.5.1 → fixed in 6.6.5.1 • Packagist shopware/core: >= 6.6.0.0, < 6.6.5.1 → fixed in 6.6.5.1

Description

Impact Shopware has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. It accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Patches Update to Shopware 6.6.5.1 or 6.5.8.13 Workarounds For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Alias · CVE (1)

  • CVE-2024-42355 Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in… vulnerability

Weakness · CWE (2)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
  • CWE-94 Improper Control of Generation of Code weakness

References