CVE-2023-2017

Executive Summary

CVE-2023-2017 is a Server-side Template Injection (SSTI) vulnerability in Shopware 6, affecting versions up to and including v6.4.20.0, as well as release candidates v6.5.0.0-rc1 through v6.5.0.0-rc4. The flaw resides in the Twig template rendering engine's security extension, specifically in Shopware\Core\Framework\Adapter\Twig\SecurityExtension, allowing an authenticated remote attacker with access to a Twig environment to bypass input validation checks and invoke arbitrary PHP functions, leading to remote code execution. This vulnerability is a bypass of a previously patched issue, CVE-2023-22731, and carries a CVSS score of 8.8, indicating high severity due to the potential for full system compromise.

Technical Analysis

Shopware 6 is an e-commerce platform built upon the Symfony framework, which uses Twig as its default templating engine. Twig provides a sandboxing mechanism to restrict the functions and methods accessible within templates, preventing untrusted template authors from executing arbitrary code.

The vulnerability exists in the custom security extension implemented by Shopware: Shopware\Core\Framework\Adapter\Twig\SecurityExtension. This class is designed to extend Twig's native security features by performing additional validation checks on function calls made within rendered templates. However, the NVD description indicates that these validation checks can be bypassed when an attacker uses fully-qualified names — i.e., complete namespace paths such as \System\Exec — supplied as an array of strings, when referencing callables.

The attack mechanism exploits how PHP resolves callables when they are provided as arrays. In PHP, a callable can be expressed as an array containing an object/class name and a method name, e.g., ['ClassName', 'methodName']. When Twig encounters such an array referencing a function, it normally passes this to the security extension for validation. The bypass allows the attacker to craft an array containing a fully-qualified class name and method name that evades the checks performed by SecurityExtension, thereby permitting calls to any arbitrary PHP function — including system-level commands such as system(), exec(), or passthru().

The root cause is an incomplete validation logic within the security extension that fails to account for the fully-qualified-name array representation of callables. The sandbox restriction can be entirely circumvented, neutralizing the intended security boundary.

Attack surface: The vulnerability is exploitable by any user or attacker who can cause Twig templates to be rendered with unsandboxed environments. In Shopware, this may include admin users with template editing capabilities, plugin developers, or scenarios where user-supplied input is improperly reflected into templates. The exact preconditions for reaching this state in Shopware 6 are not fully detailed in public advisories.

This is a bypass of CVE-2023-22731, which addressed a similar SSTI issue. The patch for that CVE (included in v6.4.20.0 or earlier) was incomplete, allowing the described array-based callable bypass to remain exploitable.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.

1. Reconnaissance/Target Identification: The attacker identifies a Shopware 6 instance running a vulnerable version (≤ v6.4.20.0, or 6.5.0.0-rc1 to rc4). This can be determined via HTTP response headers, the presence of specific paths (/api, /admin), or version disclosure in page source. Shodan queries targeting "Shopware" can be used to locate exposed instances.

2. Triggering the Flaw: The attacker must reach a position where they can influence or control the content of a Twig template rendered by the application. In Shopware, this typically requires administrative or elevated access to customize storefront themes, email templates, or CMS layouts. If such access exists, the attacker injects malicious template code into a field that is later rendered. The attacker bypasses the Twig sandbox by crafting a payload that uses a fully-qualified name supplied as an array of strings to reference a callable, thereby evading the validation in the security extension.

3. Payload/Execution Method: At the vulnerability-class level, the SSTI payload would leverage Twig's expression syntax to construct a callable array. For example, a payload resembling: {{ ['\System\Exec', 'system']|call_user_func_array(['whoami']) }} — though exact syntax is speculative. The key mechanism is bypassing the SecurityExtension validation to invoke arbitrary PHP functions. The attacker uses this to call system() or equivalent command-execution functions with a command of their choice.

4. Post-Exploitation Impact: Successful exploitation results in remote code execution under the context of the web server user (typically www-data or similar). The attacker can:

   • Read sensitive files (/etc/passwd, configuration files with database credentials).
   • Write webshells for persistent access.
   • Escalate privileges to the database or the underlying OS.
   • Pivot to internal networks.
   • Deface the shop or steal customer data (including PII and payment information at rest).
   • Encrypt files or deploy ransomware.

Impact Assessment

The vulnerability has a CVSS base score of 8.8 (High). Given the highly associated vector (though not explicitly provided in the data, it is consistent with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the key factors are:

• Attack Vector (AV: Network): Exploitable remotely over the network.
• Attack Complexity (AC: Low): No special conditions beyond reaching the template rendering; standard attacker knowledge is sufficient.
• Privileges Required (PR: Low): Requires some level of authenticated access (e.g., an admin user or a user with template-editing rights). This lowers the barrier compared to unauthenticated flaws but still requires a foothold.
• User Interaction (UI: None): No victim interaction needed.
• Scope (S: Unchanged): Compromise is confined to the vulnerable component's security authority.
• Confidentiality, Integrity, Availability Impact (All High): Complete compromise of the application and underlying server.

Affected Systems: All Shopware 6 installations running ≤ v6.4.20.0 or the specified release candidates. This includes both shopware/core and shopware/platform GitHub repositories.

Blast Radius: E-commerce platforms hold high-value data: customer PII, order histories, payment data (often tokenized), and administrative credentials. A full RCE compromises all of this and the underlying server infrastructure. The dual-repository nature means both the platform distribution and the core component are affected, impacting all deployment models (SaaS-hosted, self-hosted, and cloud-marketplace). The EPSS score of 0.02083 (79.7th percentile) suggests active exploitation is plausible, and this CVE being a bypass of a previously known vulnerability increases the likelihood of exploitation in the wild.

Detection Guidance

Sigma Rule

title: Shopware SSTI - Twig Template Injection via Fully-Qualified Callables
id: 7a3b2c1d-9f4e-4a5b-8c2d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2023-2017, a Server-Side Template Injection in Shopware 6 allowing RCE via fully-qualified callable arrays in Twig templates.
logsource:
  category: webserver
  product: nginx
  definition: 'Events related to Shopware 6 application with admin or template editing functionality.'
detection:
  selection_payload:
    ws.data|contains:
      - '\Shopware\'
      - 'call_user_func'
      - 'system('
      - 'passthru('
      - 'exec('
    http.method: POST
    http.url|contains:
      - 'admin'
      - 'api'
      - 'theme'
      - 'mail-template'
  selection_status:
    http.response: 200
  condition: selection_payload and selection_status
level: high
falsepositives:
  - Legitimate template editing with internal class references (rare)

YARA Rule

rule Shopware_SSTI_CVE_2023_2017 {
    meta:
        author = "Valter Security"
        description = "Detects Twig SSTI payloads for CVE-2023-2017 exploiting fully-qualified callables"
        date = "2024-01-01"
        cve = "CVE-2023-2017"
        severity = "high"

    strings:
        $a = "SecurityExtension"
        $b = "Shopware\\Core\\Framework\\Adapter\\Twig"
        $c = "call_user_func"
        $d = /\[\s*['\x22]\\\\[A-Za-z0-9_]+['\x22]\s*,\s*['\x22][A-Za-z0-9_]+['\x22]\s*\]/
        $e = "{{" ascii
        $f = "{%" ascii

    condition:
        uint16(0) == 0x3C21 and
        ($a or $b) and
        ($c or $d) and
        ($e or $f)
}

Suricata IDS Rule

alert http any any -> any any (msg:"SHOPWARE SSTI CVE-2023-2017 Attempt - Twig Fully-Qualified Callable Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/admin"; http_uri; content:"call_user_func"; nocase; http_client_body; content:"\\Shopware\\"; http_client_body; content:"system"; nocase; http_client_body; classtype:attempted-admin; sid:20232017; rev:1; metadata:created_at 2024_01_01, updated_at 2024_01_01, cve CVE-2023-2017;)

Elastic Detection

sequence by host.name with maxspan=30s
  [ network where dns.question.name like "*.shopware*" ]
  [ http where http.request.method == "POST" and
      (
        url.path like "/admin/*" or
        url.path like "/api/*" or
        url.path like "/theme/*" or
        url.path like "/mail-template/*"
      ) and
      (
        http.request.body.content contains "call_user_func" or
        http.request.body.content contains "\\Shopware\\" or
        http.request.body.content matches "\\\\[A-Za-z0-9_]+"
      ) and
      http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| search (uri_path="/admin/*" OR uri_path="/api/*" OR uri_path="/theme/*")
| search form_data="*call_user_func*" OR form_data="*\\Shopware\\*" OR form_data="*system*" OR form_data="*passthru*"
| table _time, src_ip, host, uri_path, form_data, status
| where status=200
| eval suspicious=if(match(form_data, "\\\\[A-Za-z0-9_]+"), "HIGH", "MEDIUM")

Wazuh OSSEC Rule

<group name="shopware,">
  <rule id="100317" level="14">
    <decoded_as>web-access</decoded_as>
    <field name="method">POST</field>
    <field name="url">\./admin|/api|/theme</field>
    <match>call_user_func|\\Shopware\\|passthru|system\(</match>
    <description>Shopware SSTI exploitation attempt (CVE-2023-2017)</description>
    <group>attack,template_injection,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED). The only patch source is the CNA itself (Shopware), and while the advisory is credible, it has not been independently confirmed by a second party.

1. Immediate Mitigations:

   • Apply the official patch: Upgrade to Shopware v6.4.20.1 immediately. This is the only version confirmed to resolve the issue.
   • If immediate upgrade is impossible, restrict administrative access to trusted IPs using firewall rules or VPN. Since exploitation requires low-privilege access (likely template editing), enforcing strict access control to admin panels significantly reduces the attack surface.
   • Disable or restrict Twig template editing capabilities for non-essential users, and audit existing templates for code not fully vetted by the development team.
   • Monitor logs for the patterns outlined in the Detection Guidance section above; any hits should be treated as potential compromise.

2. Patch/Upgrade Steps:

   • For shopware/platform or shopware/core (Composer-based installations):

     composer require shopware/platform:6.4.20.1 --update-with-dependencies
     

     Or use composer update shopware/core shopware/platform --with-all-dependencies.
   • For managed/SaaS deployments: ensure the hosting provider applies the update.
   • After upgrade, run bin/console cache:clear and re-deploy assets (bin/console assets:install).
   • Verify the installed version via the admin panel or composer show.

3. Long-Term Hardening:

   • Maintain an upgrade cadence within 30 days of security releases (Shopware releases hotfixes regularly).
   • Implement a Web Application Firewall (WAF) with rules to detect SSTI payloads.
   • Adopt the principle of least privilege: separate template editing roles from general admin roles.
   • Conduct periodic code audits of all custom templates and plugins, especially those handling user input.
   • Enable automated vulnerability scanning (e.g., using the EPSS data — this CVE has a 79.7th percentile EPSS score, indicating above-average exploitability).
   • Subscribe to Shopware security advisories and monitor the CVE feed for bypasses or follow-ups.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-2017
2. Shopware Advisory (CNA): https://www.shopware.com/en/security/security-information/ (referencing v6.4.20.1 release notes)
3. Related CVE (predecessor): CVE-2023-22731 — Shopware SSTI vulnerability (this CVE bypasses it)
4. GitHub Repositories: https://github.com/shopware/platform and https://github.com/shopware/core (older branches containing affected code)
5. Exploit-in-the-wild evidence: No known CISA KEV listing, no confirmed public exploit; however, the EPSS percentile (79.7%) suggests active scanning/harvesting of this vulnerability class. No threat-actor campaigns have been publicly attributed to this CVE as of the writing of this report.