CVE-2024-42356
highpriority · track · 29EPSS 0.006 · 51 %ileEUUSEPSS · scored 2026-10-27
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-35jp-8cgg-p4wjShopware vulnerable to Server Side Template Injection in Twig using Context functions2024-08-08ghsa · osvUS
### Impact The `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: ```php $context->scope(Context::SYSTEM_SCOPE, static function (Context $context) use ($mediaService, $media, &$fileBlob): void { $fileBlob = $mediaService->loadFile($media->getId(), $context); }); ``` This function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. ### Patches Update to Shopware 6.6.5.1 or 6.5.8.13 ### Workarounds For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-42356/cnnvd
- https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038cnnvd
- https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fcnnvd
- https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0accnnvd
- https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2ecnnvd
- https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wjcnnvd
- https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038enisa_euvd
- https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan