CVE-2023-34098: Dependency configuration exposed in Shopware
Impact Due to a wrong configuration in the .htaccess file, the configuration file of Javascript dependencies could be read in production environments (themes/package-lock.json). With this information, the used Shopware version might be determined by an attacker, which could be used for further attacks.
Patches We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
Other sources
Shopware is an open source e-commerce software. Due to an incorrect configuration in the .htaccess file, the configuration file of the Javascript could be read in production environments (themes/package-lock.json). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/shopware/shopwareto a version that resolves this vulnerability.Fixed in 5.7.18 - Upgrade
Upgrade
Shopware 5to a version that resolves this vulnerability.Fixed in 5.7.18 - Configuration
Fix the wrong .htaccess configuration so the Javascript dependency configuration file themes/package-lock.json cannot be read in production environments.
Web server (.htaccess) .htaccess access rules for themes/package-lock.json (Javascript dependency configuration) = Prevent reading of themes/package-lock.json in production
Event History
Frequently Asked Questions
What is CVE-2023-34098?
CVE-2023-34098 is a vulnerability in Shopware, an open-source e-commerce software, that allows an attacker to read the configuration file of the Javascript in production environments.
What is the severity of CVE-2023-34098?
The severity of CVE-2023-34098 is medium with a severity value of 5.3.
How does CVE-2023-34098 affect Shopware?
CVE-2023-34098 affects Shopware versions between 5.6.0 and 5.7.18.
How can I fix CVE-2023-34098?
To fix CVE-2023-34098, update your Shopware installation to a version later than 5.7.18 and make sure the `.htaccess` file is correctly configured.
Where can I find more information about CVE-2023-34098?
You can find more information about CVE-2023-34098 in the Shopware security updates documentation and the Shopware GitHub advisory.