CVE-2025-67648: Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page
Impact
By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.
Description
A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter waitTime lacks proper input validation.
The attack can be tested with the following URL pattern:
/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>
The same applies to the errorSnippet parameter:
/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.
Other sources
Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67648?
CVE-2025-67648 is considered a high severity vulnerability due to its potential to allow XSS attacks that can compromise user sessions.
How do I fix CVE-2025-67648?
To fix CVE-2025-67648, you should update Shopware and storefront packages to version 6.7.5.1 or 6.6.10.10 as applicable.
What are the risks associated with CVE-2025-67648?
The risks associated with CVE-2025-67648 include unauthorized access to user session tokens and the ability for attackers to perform actions in a user's session.
Which versions of Shopware are affected by CVE-2025-67648?
CVE-2025-67648 affects Shopware versions from 6.4.6.0 to 6.7.5.1.
Can CVE-2025-67648 lead to data theft?
Yes, CVE-2025-67648 can potentially lead to data theft if an attacker successfully exploits the XSS vulnerability to hijack user sessions.