Platform
php
Component
shopware
Opgelost in
6.5.8
CVE-2024-22406 describes a critical SQL injection vulnerability discovered in Shopware, a popular open-source headless commerce platform. This flaw resides within the application API's search functionality, specifically in the aggregation parameters. Successful exploitation allows attackers to inject malicious SQL queries, potentially leading to data breaches and system compromise. The vulnerability affects Shopware versions up to 6.5.7.4, and a patch is available in version 6.5.7.4.
The impact of this SQL injection vulnerability is severe. An attacker can leverage the 'name' field within the 'aggregations' object of the search API to craft time-based SQL injection queries. This allows them to bypass authentication and authorization controls, potentially extracting sensitive data stored within the Shopware instance. Depending on the database configuration and data stored, this could include customer information (names, addresses, payment details), product data, order history, and administrative credentials. Successful exploitation could lead to complete data exfiltration, modification, or even deletion, severely disrupting business operations and damaging customer trust. The open-source nature of Shopware means a wide range of deployments are potentially vulnerable, increasing the overall attack surface.
CVE-2024-22406 was publicly disclosed on January 16, 2024. While no active exploitation campaigns have been definitively confirmed, the vulnerability's critical severity and the ease of exploitation (time-based SQL injection) make it a high-priority target. It is not currently listed on CISA KEV, but its severity warrants close monitoring. Public proof-of-concept exploits are likely to emerge, increasing the risk of widespread exploitation.
Organizations utilizing Shopware for their e-commerce operations, particularly those running versions prior to 6.5.7.4, are at significant risk. This includes businesses relying on Shopware's API for integrations with third-party services, as well as shared hosting environments where multiple Shopware instances might be vulnerable due to misconfigured security settings.
• php: Examine Shopware application logs for unusual SQL queries involving the search API endpoint. Look for patterns indicative of time-based SQL injection attempts.
grep -i 'sleep(' /var/log/shopware/application.log• generic web: Monitor web server access logs for requests to the Shopware search API endpoint with suspicious parameters in the 'aggregations.name' field.
grep 'aggregations.name=' /var/log/apache2/access.log• database (mysql): If database access is possible, review slow query logs for queries originating from the Shopware application that exhibit characteristics of SQL injection attempts.
SHOW PROCESSLIST; -- Look for long-running queriesdisclosure
patch
Exploit Status
EPSS
0.22% (45% percentiel)
CVSS-vector
The primary mitigation for CVE-2024-22406 is to immediately upgrade to Shopware version 6.5.7.4 or later. This version includes a fix that addresses the SQL injection vulnerability. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. While not a complete solution, input validation on the 'name' field within the search API aggregations can help reduce the attack surface. Web application firewalls (WAFs) configured to detect and block SQL injection attempts targeting the search API endpoint can also provide an additional layer of protection. Monitor Shopware logs for suspicious SQL queries or unusual database activity. After upgrading, confirm the fix by attempting a search query with a known malicious SQL injection payload and verifying that it is properly sanitized.
Actualice Shopware a la versión 6.5.7.4 o superior. Si no puede actualizar inmediatamente, Shopware proporciona un plugin de seguridad para versiones anteriores (6.1, 6.2, 6.3 y 6.4). Se recomienda actualizar a la última versión de Shopware para obtener todas las funciones y correcciones de seguridad.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2024-22406 is a critical SQL injection vulnerability affecting Shopware versions up to 6.5.7.4, allowing attackers to potentially extract sensitive data through the search API.
If you are running Shopware versions 6.1, 6.2, 6.3, 6.4, or 6.5.7.4 or earlier, you are potentially affected and should upgrade immediately.
The recommended fix is to upgrade to Shopware version 6.5.7.4 or later. Temporary workarounds include input validation and WAF rules.
While no confirmed active exploitation campaigns are publicly known, the vulnerability's severity and ease of exploitation suggest a high risk of future attacks.
Refer to the official Shopware security advisory for detailed information and updates: [https://shopware.com/security/advisories/](https://shopware.com/security/advisories/)
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.