CVE-2022-24872
📋 TL;DR
CVE-2022-24872 is an incorrect permission assignment vulnerability in Shopware where permissions granted via admin API in sales channel context remain active in normal user sessions. This allows authenticated users to potentially access administrative functions they shouldn't have. All Shopware installations using affected versions are vulnerable.
💻 Affected Systems
- Shopware
📦 What is this software?
Shopware by Shopware
⚠️ Risk & Real-World Impact
Worst Case
Authenticated users could gain administrative privileges, leading to data theft, system compromise, or complete platform takeover.
Likely Case
Users with some permissions could escalate privileges to access restricted administrative functions and sensitive data.
If Mitigated
With proper access controls and monitoring, impact is limited to potential unauthorized access to specific administrative functions.
🎯 Exploit Status
Exploitation requires authenticated user access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.10.1
Vendor Advisory: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022
Restart Required: No
Instructions:
1. Update to Shopware 6.4.10.1 via composer update or Shopware updater. 2. For older versions (6.1, 6.2, 6.3), install the security plugin from Shopware store. 3. Clear cache after update.
🧯 If You Can't Patch
- Implement strict access control monitoring for administrative functions.
- Segment network access to Shopware admin interfaces.
🔍 How to Verify
Check if Vulnerable:
Check Shopware version via admin panel or composer.json. If version is below 6.4.10.1 and no security plugin is installed for older versions, system is vulnerable.Check Version:
php bin/console system:info | grep VersionVerify Fix Applied:
Verify version is 6.4.10.1 or higher, or confirm security plugin is installed for older versions.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to admin API endpoints
- Users accessing functions outside their normal role permissions
Network Indicators:
- Increased traffic to administrative endpoints from non-admin users
SIEM Query:
source="shopware.logs" AND (event="admin_api_access" OR event="permission_violation") AND user_role!="admin"🔗 References
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022
- https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c
- https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022
- https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c
- https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc
