CVE-2024-27917
📋 TL;DR
This vulnerability in Shopware allows session fixation attacks where cached 404 pages inadvertently expose session cookies to subsequent users. Attackers can hijack user sessions when accessing cached error pages. Affects Shopware installations using default Symfony session handling without Redis.
💻 Affected Systems
- Shopware
📦 What is this software?
Shopware by Shopware
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to user accounts, perform administrative actions, steal sensitive data, or compromise the entire Shopware instance.
Likely Case
Session hijacking leading to unauthorized access to customer accounts, potential data theft, and fraudulent transactions.
If Mitigated
Limited to isolated session issues if proper session management and monitoring are implemented.
🎯 Exploit Status
Exploitation requires accessing cached 404 pages to harvest session cookies. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.8.7
Vendor Advisory: https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m
Restart Required: Yes
Instructions:
1. Backup your Shopware installation. 2. Update to Shopware 6.5.8.7 via composer: composer require shopware/core:6.5.8.7 shopware/administration:6.5.8.7 shopware/storefront:6.5.8.7. 3. Clear caches: bin/console cache:clear. 4. Restart PHP-FPM or web server.
🔧 Temporary Workarounds
Configure Redis Session Handler
allUse Redis for session storage instead of default Symfony handler to bypass vulnerable code path.
Configure Redis session handler in .env: SESSION_REDIS_HOST=redis
Install Redis extension: pecl install redis
Update Shopware config to use redis sessions
🧯 If You Can't Patch
- Disable 404 page caching in Shopware configuration
- Implement strict session validation and monitoring
🔍 How to Verify
Check if Vulnerable:
Check Shopware version: php bin/console --version. If version is between 6.5.8.0 and 6.5.8.6 and not using Redis sessions, system is vulnerable.Check Version:
php bin/console --versionVerify Fix Applied:
Confirm version is 6.5.8.7 or higher: php bin/console --version | grep 6.5.8.7📡 Detection & Monitoring
Log Indicators:
- Multiple session creations from same IP accessing 404 pages
- Unusual session cookie patterns in access logs
Network Indicators:
- Abnormal requests to non-existent URLs triggering 404 responses
- Session cookie reuse across different user agents
SIEM Query:
source="shopware.log" AND "404" AND "session" AND "cookie"🔗 References
- https://github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3
- https://github.com/shopware/shopware/releases/tag/v6.5.8.7
- https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m
- https://github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e
- https://github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3
- https://github.com/shopware/shopware/releases/tag/v6.5.8.7
- https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m
- https://github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e
