CVE-2024-42355: Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Impact
Shopware has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. It accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code.
Patches Update to Shopware 6.6.5.1 or 6.5.8.13
Workarounds For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Other sources
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42355?
CVE-2024-42355 is classified as a security vulnerability that allows remote code execution due to improper handling of parameters.
How do I fix CVE-2024-42355?
To resolve CVE-2024-42355, update Shopware to version 6.6.5.1 or 6.5.8.13.
What are the affected versions for CVE-2024-42355?
CVE-2024-42355 affects Shopware versions between 6.6.0.0 and 6.6.5.0 as well as versions up to 6.5.8.12.
What functionality does the new Twig Tag `sw_silent_feature_call` provide related to CVE-2024-42355?
The `sw_silent_feature_call` allows silencing of deprecation messages but introduces a risk of code execution if misused.
Is there a workaround for CVE-2024-42355?
There is no confirmed workaround for CVE-2024-42355, and updating to the patched versions is recommended.