CVE-2024-42355
📋 TL;DR
Shopware's sw_silent_feature_call Twig tag has improper input escaping, allowing code execution through the feature flag name parameter. This affects all Shopware installations prior to versions 6.6.5.1 and 6.5.8.13. Attackers can exploit this to execute arbitrary code on vulnerable Shopware servers.
💻 Affected Systems
- Shopware
📦 What is this software?
Shopware by Shopware
Shopware by Shopware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and server takeover.
Likely Case
Arbitrary code execution allowing attackers to modify shop content, steal customer data, or install backdoors.
If Mitigated
Limited impact with proper input validation and output encoding in place, but still potentially exploitable.
🎯 Exploit Status
The vulnerability is in a Twig tag that accepts user input without proper escaping, making exploitation straightforward once the attack vector is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.5.1 or 6.5.8.13
Vendor Advisory: https://github.com/shopware/shopware/security/advisories/GHSA-27wp-jvhw-v4xp
Restart Required: Yes
Instructions:
1. Update Shopware to version 6.6.5.1 or 6.5.8.13. 2. For older versions (6.2, 6.3, 6.4), install the corresponding security plugin. 3. Clear caches and restart the application server.
🔧 Temporary Workarounds
Disable vulnerable Twig tag
allTemporarily disable or restrict usage of the sw_silent_feature_call tag
Modify Twig configuration to remove or restrict the tag
🧯 If You Can't Patch
- Implement strict input validation for all Twig tag parameters
- Deploy web application firewall rules to block suspicious Twig template injections
🔍 How to Verify
Check if Vulnerable:
Check Shopware version via admin panel or by examining composer.json versionCheck Version:
php bin/console --versionVerify Fix Applied:
Verify version is 6.6.5.1 or higher, or 6.5.8.13 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual Twig template errors
- Suspicious feature flag names in logs
- Unexpected code execution in template rendering
Network Indicators:
- HTTP requests with unusual parameters to template endpoints
- Patterns matching Twig injection attempts
SIEM Query:
web_requests WHERE (uri CONTAINS 'template' OR uri CONTAINS 'twig') AND (params CONTAINS 'sw_silent_feature_call' OR params MATCHES /[^\w\-]/)🔗 References
- https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
- https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2
- https://github.com/shopware/shopware/commit/445c6763cc093fbd651e0efaa4150deae4ae60da
- https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
- https://github.com/shopware/shopware/security/advisories/GHSA-27wp-jvhw-v4xp
