CVE-2022-24871

Executive Summary

CVE-2022-24871 is a server-side request forgery (SSRF) vulnerability in the Shopware open commerce platform, which is built on the Symfony Framework and Vue.js. The flaw resides in the Admin SDK functionality, allowing an authenticated or unauthenticated attacker to abuse server-side requests to read or update internal resources that should not be exposed. Affected deployments include all Shopware instances prior to version 6.4.10.1, with older 6.1, 6.2, and 6.3 branches requiring a security plugin to remediate. Successful exploitation can lead to unauthorized access to internal infrastructure, including cloud metadata endpoints, internal APIs, and other sensitive network resources.

Technical Analysis

CVE-2022-24871 was disclosed by the CNA (Shopware) as a Server-Side Request Forgery (SSRF) vulnerability. The NVD description provides limited implementation-specific detail, but the vulnerability class and attack surface are clearly identifiable.

Vulnerability Mechanism (Class-Level):

SSRF vulnerabilities arise when an application accepts user-supplied URLs or network destinations and fetches them server-side without adequate validation of the target host, IP address, or port. In the context of Shopware's Admin SDK, the server-side component appears to expose functionality that accepts URL/resource references from the client and subsequently performs HTTP requests to those references on the server's behalf. The abuse of this functionality allows an attacker to read or update internal resources — meaning the server will perform GET or write operations against internal network addresses that are otherwise protected from direct external access.

Attack Surface:

The attack surface is the Admin SDK endpoint(s) exposed by the Shopware application. This is a publicly reachable API surface in typical deployments, since Shopware is an e-commerce platform whose admin panel and API are commonly internet-accessible. The SDK functionality is designed to integrate admin-side features and likely accepts request parameters that include destination URLs or resource locators. Because the NVD description does not enumerate specific parameter names or endpoint paths, the exact request structure remains undisclosed in public data.

Technical Specifics (limited by available data):

The NVD description states: "an attacker can abuse the Admin SDK functionality on the server to read or update internal resources." This indicates the server-side request logic performs both GET (read) and write (update) operations. The phrase "internal resources" strongly implies the SSRF can target:

• RFC1918 private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Localhost (127.0.0.1) and loopback
• Cloud metadata services (e.g., 169.254.169.254)
• Internal service discovery endpoints and microservice APIs

Affected Architecture:

Shopware is a PHP-based commerce platform built on the Symfony Framework with a Vue-based frontend. The Admin SDK is a relatively newer feature that allows programmatic extension of the admin panel. The SSRF is likely present in the server-side handler that proxies or fetches resources for the SDK UI components.

Insufficient technical detail is available regarding the exact input validation weaknesses, URL parser bypasses, or redirect handling that enable the SSRF. The patch in version 6.4.10.1 presumably introduces URL validation (e.g., disallowing private IP ranges, enforcing allowlists) and/or restricts the SDK's network access capabilities.

Exploitation Scenarios

No public PoC is available; attack chain is inferred from vulnerability class and NVD description. The following scenario is representative:

Step 1 — Reconnaissance / Target Identification: An attacker identifies a publicly accessible Shopware instance. This can be done via Shodan/Censys searching for "Shopware" banners, or by fingerprinting the application via its distinctive login pages, JavaScript asset filenames, or HTTP headers. The attacker then determines the Shopware version by probing version-specific assets or reading the VERSION file typically exposed in the installation root.

Step 2 — Triggering the Specific Flaw: The attacker accesses the Admin SDK functionality. This may require authentication (depending on the exact nature of the exposed endpoint), or may be reachable pre-authentication if the SDK registers public routes. The attacker crafts a request to the SDK endpoint, supplying a URL that points to an internal resource. Because the server-side handler fails to validate the destination host, the server accepts the request and initiates a server-side HTTP connection to the attacker-supplied URL.

Step 3 — Payload / Execution Method (Class-Level): The attacker supplies a payload URL such as:

• http://169.254.169.254/latest/meta-data/ — for cloud metadata extraction
• http://127.0.0.1:9200/ — for local Elasticsearch access
• http://192.168.1.100/internal-api/resource — for internal service interaction

For "update" operations, the SDK may support POST/PUT semantics, allowing the attacker to modify internal resources or issue state-changing requests to internal services.

Step 4 — Post-Exploitation Impact: Depending on the target internal resource, the attacker can:

• Steal cloud instance credentials (IAM role temporary credentials) from cloud metadata endpoints
• Read configuration files, database credentials, or application secrets from internal services
• Issue privileged API calls to internal management interfaces (e.g., Kubernetes API, Docker daemon)
• Perform internal network scanning and service enumeration through error messages or response timing

The full extent of post-exploitation is constrained by the SSRF's ability to both read and write, which significantly broadens the impact beyond simple data exfiltration to include potential internal state modification.

Impact Assessment

CVSS Context (Score: 7.2, High): The low attack complexity, external network attack vector, and high confidentiality impact drive this score. The scope change component (if applicable to this vector) indicates the compromise can extend beyond the initially compromised component to the broader infrastructure.

Business Impact:

• Confidentiality: High — internal resource contents, credentials, and sensitive configuration data may be exfiltrated.
• Integrity: Moderate-to-High — the "update" capability permits modification of internal resources, potentially altering application configuration or injecting malicious content.
• Availability: Indirect — if internal monitoring or management APIs are disrupted, availability may degrade.

Affected Systems: All Shopware installations running versions prior to 6.4.10.1, including the 6.1, 6.2, and 6.3 branches, are vulnerable. E-commerce operations relying on Shopware (approximately a significant share of German-language e-commerce) are the primary affected population.

Blast Radius: In worst-case cloud deployments, the SSRF can reach cloud metadata services to harvest temporary IAM credentials, enabling lateral movement into cloud accounts. In on-premises deployments, internal network reconnaissance and service exploitation are likely. The dual read/write capability increases the blast radius over typical read-only SSRF flaws.

Detection Guidance

Sigma Rule

title: Potential SSRF Exploitation via Shopware Admin SDK
id: 2732c2b3-4ac4-4ef7-82c3-51d5c1739dea
status: experimental
description: Detects HTTP requests targeting Shopware Admin SDK endpoints with suspicious destination URLs indicative of SSRF
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
  category: webserver
  product: apache
  definition: 'requirements: access logs or reverse proxy logs from Shopware deployments'
detection:
  selection_path:
    cs-uri-query|contains:
      - 'admin-sdk'
      - 'AdminSDK'
      - 'sdk'
  selection_ssrf:
    cs-uri-query|contains:
      - 'localhost'
      - '127.0.0.1'
      - '169.254.169.254'
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '0.0.0.0'
  condition: selection_path and selection_ssrf
  falsepositives:
    - Legitimate admin SDK integration with internal services
    - Testing or debugging activities by developers
  level: high

YARA Rule

rule Shopware_AdminSDK_SSRF {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects content patterns indicative of SSRF exploitation against Shopware Admin SDK"
        cve = "CVE-2022-24871"
        date = "2024-01-15"
        severity = "high"
    strings:
        $sdk1 = "http://169.254.169.254/latest/meta-data" ascii wide nocase
        $sdk2 = "http://localhost" ascii wide nocase
        $sdk3 = "http://127.0.0.1" ascii wide nocase
        $sdk4 = "http://10.0." ascii wide nocase
        $sdk5 = "http://10.1." ascii wide nocase
        $sdk6 = "http://192.168." ascii wide nocase
        $sdk7 = "http://172.16." ascii wide nocase
        $sdk8 = "http://172.17." ascii wide nocase
        $sdk9 = "/admin-sdk" ascii wide nocase
        $sdk10 = "/api/_action" ascii wide nocase
    condition:
        2 of ($sdk1, $sdk2, $sdk3, $sdk4, $sdk5, $sdk6, $sdk7, $sdk8) and 1 of ($sdk9, $sdk10)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2022-24871 - Shopware Admin SDK SSRF Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/admin-sdk"; http_uri; content:"http://"; distance:0; http_uri; content:!".com"; content:!"example"; content:"169.254.169.254"; within:200; flowbits:set,shopware_ssrf; sid:2022487101; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15, cve CVE-2022-24871;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ any where event.category == "http" and url.path contains "/admin-sdk" ]
  [ any where event.category == "http" and (
      url.full RLIKE "(http://)(localhost|127\\.0\\.0\\.1|10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|169\\.254\\.169\\.254).*" 
      or url.full contains "169.254.169.254"
    ) ]

Splunk SPL Query

index=proxy OR index=iis OR index=apache 
  (uri_path="*/admin-sdk*" OR uri_path="*/api/sdk*" OR url_path="*/admin-sdk*")
  AND (uri_query="*localhost*" OR uri_query="*127.0.0.1*" OR uri_query="*169.254.169.254*"
       OR uri_query="*192.168.*" OR uri_query="*10.*" OR uri_query="*172.16*" 
       OR uri_query="*172.17*" OR uri_query="*172.18*" OR uri_query="*172.19*" 
       OR uri_query="*172.20*" OR uri_query="*172.21*" OR uri_query="*172.22*" 
       OR uri_query="*172.23*" OR uri_query="*172.24*" OR uri_query="*172.25*" 
       OR uri_query="*172.26*" OR uri_query="*172.27*" OR uri_query="*172.28*" 
       OR uri_query="*172.29*" OR uri_query="*172.30*" OR uri_query="*172.31*")
  OR uri_query="*http://0.0.0.0*"
| stats count by src_ip, dest_ip, uri, user_agent
| where count > 1