Impact
It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API.
Patches Update to Shopware 6.6.10.3 or 6.5.8.17
Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Impact
The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.
Patches
Update to Shopware 6.6.10.3
Workarounds
For older versions of 6.5 or 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Credit
Redteam Pentesting
Impact
Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation.
Default settings are:
Newsletter: Double Opt-in - active
Newsletter: Double opt-in for registered customers - disabled
Log-in & sign-up: Double opt-in on sign-up - disabled
With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”.
Patches Update to Shopware 6.6.10.3 or 6.5.8.17
Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Impact Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop.
Using the store-api endpoint /store-api/account/recovery-password you get the response {"errors":[{"status":"404","code":"CHECKOUTCUSTOMERNOTFOUND","title":"Not Found","detail":"No matching customer for the email \u0022asdasfd@asdads.de\u0022 was found.","meta":{"parameters":{"email":"asdasfd@asdads.de"}}}]}
which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found.
Patches Update to Shopware 6.6.10.3
Workarounds For older versions of 6.5 or 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.