Platform
php
Component
shopware
Fixed in
6.5.8
CVE-2024-22406 describes a critical SQL injection vulnerability discovered in Shopware, a popular open-source headless commerce platform. This flaw resides within the application API's search functionality, specifically in the aggregation parameters. Successful exploitation allows attackers to inject malicious SQL queries, potentially leading to data breaches and system compromise. The vulnerability affects Shopware versions up to 6.5.7.4, and a patch is available in version 6.5.7.4.
The impact of this SQL injection vulnerability is severe. An attacker can leverage the 'name' field within the 'aggregations' object of the search API to craft time-based SQL injection queries. This allows them to bypass authentication and authorization controls, potentially extracting sensitive data stored within the Shopware instance. Depending on the database configuration and data stored, this could include customer information (names, addresses, payment details), product data, order history, and administrative credentials. Successful exploitation could lead to complete data exfiltration, modification, or even deletion, severely disrupting business operations and damaging customer trust. The open-source nature of Shopware means a wide range of deployments are potentially vulnerable, increasing the overall attack surface.
CVE-2024-22406 was publicly disclosed on January 16, 2024. While no active exploitation campaigns have been definitively confirmed, the vulnerability's critical severity and the ease of exploitation (time-based SQL injection) make it a high-priority target. It is not currently listed on CISA KEV, but its severity warrants close monitoring. Public proof-of-concept exploits are likely to emerge, increasing the risk of widespread exploitation.
Exploit Status
EPSS
0.22% (45% percentile)
CVSS Vector
The primary mitigation for CVE-2024-22406 is to immediately upgrade to Shopware version 6.5.7.4 or later. This version includes a fix that addresses the SQL injection vulnerability. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. While not a complete solution, input validation on the 'name' field within the search API aggregations can help reduce the attack surface. Web application firewalls (WAFs) configured to detect and block SQL injection attempts targeting the search API endpoint can also provide an additional layer of protection. Monitor Shopware logs for suspicious SQL queries or unusual database activity. After upgrading, confirm the fix by attempting a search query with a known malicious SQL injection payload and verifying that it is properly sanitized.
Actualice Shopware a la versión 6.5.7.4 o superior. Si no puede actualizar inmediatamente, Shopware proporciona un plugin de seguridad para versiones anteriores (6.1, 6.2, 6.3 y 6.4). Se recomienda actualizar a la última versión de Shopware para obtener todas las funciones y correcciones de seguridad.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-22406 is a critical SQL injection vulnerability affecting Shopware versions up to 6.5.7.4, allowing attackers to potentially extract sensitive data through the search API.
If you are running Shopware versions 6.1, 6.2, 6.3, 6.4, or 6.5.7.4 or earlier, you are potentially affected and should upgrade immediately.
The recommended fix is to upgrade to Shopware version 6.5.7.4 or later. Temporary workarounds include input validation and WAF rules.
While no confirmed active exploitation campaigns are publicly known, the vulnerability's severity and ease of exploitation suggest a high risk of future attacks.
Refer to the official Shopware security advisory for detailed information and updates: [https://shopware.com/security/advisories/](https://shopware.com/security/advisories/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.