CVE-2023-2017: shopware from 6.1.0 (inclusive), through 6.4.20.0 (inclusive), 6.5.0.0 · update rc1, 6.5.0.0 · update rc2 (+1 more…

Affected technology

shopware · from 6.1.0 (inclusive), through 6.4.20.0 (inclusive)
shopware

shopware · 6.5.0.0 · update rc1
shopware

shopware · 6.5.0.0 · update rc2
shopware

shopware · 6.5.0.0 · update rc3
shopware

Shopware 6 · 0 through 6.4.20.0, 6.5.0.0-rc1 through 6.5.0.0-rc4
Shopware AG

Component: Not specified by the source
Function: and

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Remote attackers with access to a Twig environment without the Sandbox extension can bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.