CVE-2024-42354

Executive Summary

CVE-2024-42354 is an improper access control vulnerability in the Shopware open commerce platform. The vulnerability resides in the store-API's handling of entity associations, specifically ManyToMany relationships. When processing a Criteria object, the API fails to properly enforce the ApiAware field restrictions on ManyToMany associations. This allows an unauthenticated attacker to potentially access sensitive data that should not be exposed through the public API. The vulnerability is rated with a CVSS score of 5.3 (Medium) and has a low EPSS score of 0.0%, indicating limited active exploitation at the time of analysis. The issue cannot be reproduced with default Shopware entities but can be triggered by custom extensions that define ManyToMany associations.

Supply Chain & Package Security

This vulnerability affects the Shopware platform, which is distributed as a PHP package via Composer. The core issue is in the platform's API layer, not in a specific third-party package. However, the exploitability depends on custom extensions that define ManyToMany associations. This highlights the importance of supply chain security for Shopware extensions, as a vulnerable extension can expose the platform to this attack.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized data disclosure but requires specific conditions (custom extensions with ManyToMany associations) to be exploitable. The low EPSS score suggests limited active exploitation.

Deep Dive & Mechanics

The Shopware store-API is designed to expose only fields marked as ApiAware in the EntityDefinition. This is a security mechanism to prevent sensitive internal data from being exposed through the public API. The vulnerability occurs because the processing of the Criteria object does not properly consider ManyToMany associations. When a request includes a ManyToMany association in the criteria, the API fails to apply the ApiAware filter to the associated entities, potentially exposing fields that should be hidden.

Root Cause: The Criteria processing logic in the API layer does not recursively apply the ApiAware check to entities accessed via ManyToMany associations. This means that if an extension defines a ManyToMany relationship to an entity that has non-ApiAware fields, those fields can be exposed through the API.

Attack Vector: An unauthenticated attacker can craft a store-API request that includes a ManyToMany association in the criteria. By manipulating the request parameters, the attacker can force the API to return data from associated entities that should not be publicly accessible.

Prerequisites:

• The Shopware instance must have a custom extension installed that defines a ManyToMany association to an entity with sensitive fields.
• The attacker must know or guess the structure of the association.

Vulnerable vs. Patched Code

Vulnerable Code (Shopware < 6.6.5.1 / < 6.5.8.13): The vulnerable code is in the Criteria processing logic. The following is a simplified representation of the vulnerable behavior:

// Vulnerable: Does not check ApiAware for ManyToMany associations
public function processCriteria(Criteria $criteria, EntityDefinition $definition): array
{
    $data = [];
    foreach ($criteria->getAssociations() as $association) {
        // Directly processes association without ApiAware check
        $data[$association->getName()] = $this->processAssociation($association);
    }
    return $data;
}

Patched Code (Shopware >= 6.6.5.1 / >= 6.5.8.13): The patched code adds an ApiAware check for all associations, including ManyToMany:

// Patched: Checks ApiAware for all associations
public function processCriteria(Criteria $criteria, EntityDefinition $definition): array
{
    $data = [];
    foreach ($criteria->getAssociations() as $association) {
        // Check if the association is ApiAware
        if ($this->isAssociationApiAware($association, $definition)) {
            $data[$association->getName()] = $this->processAssociation($association);
        }
    }
    return $data;
}

private function isAssociationApiAware(Association $association, EntityDefinition $definition): bool
{
    $field = $definition->getField($association->getName());
    return $field && $field->isApiAware();
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of Shopware (e.g., 6.5.8.12).
2. Install a custom extension that defines a ManyToMany association to an entity with sensitive fields (e.g., a Customer entity with a notes field that is not ApiAware).
3. Ensure the extension is active.

Exploitation Steps:

1. Identify the ManyToMany association name (e.g., relatedCustomers).
2. Craft a store-API request that includes this association in the criteria:

   GET /store-api/product/{id}?associations[relatedCustomers][associations][notes][]=true
   

3. The API will return the product data along with the relatedCustomers data, including the sensitive notes field.

Example Request:

GET /store-api/product/12345?associations[relatedCustomers][associations][notes][]=true HTTP/1.1
Host: vulnerable-shopware-instance.com
Accept: application/json

Expected Response:

{
    "id": "12345",
    "name": "Product Name",
    "relatedCustomers": [
        {
            "id": "67890",
            "name": "Customer Name",
            "notes": "Sensitive internal note"
        }
    ]
}

Blue Team

Detection:

• Monitor store-API requests for unusual association parameters, especially those that include nested associations.
• Look for requests that attempt to access fields that are not typically exposed (e.g., notes, internalNotes, adminOnly).

Mitigation:

• Apply the patch immediately by updating to Shopware 6.6.5.1 or 6.5.8.13.
• For older versions, install the security plugin provided by Shopware.
• Review all custom extensions for ManyToMany associations and ensure they do not expose sensitive data.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual store-API requests with deeply nested associations parameters.
  • Requests to endpoints that return data from ManyToMany associations that should not be publicly accessible.

• Log IOCs:

  • Log entries showing access to store-API endpoints with unexpected association parameters.
  • Error logs indicating attempts to access non-ApiAware fields.

• File IOCs:

  • Modified EntityDefinition files in custom extensions that expose sensitive fields.

Detection Engineering

YARA Rule

rule CVE_2024_42354_Shopware_ApiAware_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2024-42354 by looking for ManyToMany association parameters in store-API requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-42354"
        severity = "medium"
    strings:
        $association_param = /associations\[[^\]]+\]\[associations\]/ nocase
        $sensitive_field = /(notes|internalNotes|adminOnly|secret)/ nocase
    condition:
        $association_param and $sensitive_field
}

Sigma Rule

title: CVE-2024-42354 Shopware API Association Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-42354 by abusing ManyToMany associations in Shopware store-API
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42354
logsource:
    category: webserver
    product: shopware
detection:
    selection:
        http.url|contains: 
            - 'associations['
            - 'associations]['
    condition: selection
falsepositives:
    - Legitimate use of associations in API requests
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42354 Shopware API Association Exploitation"; flow:to_server; content:"associations["; http_uri; content:"associations]["; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Shopware: Upgrade to version 6.6.5.1 or 6.5.8.13 immediately.
2. Apply Security Plugin: For older versions (6.2, 6.3, 6.4), install the security plugin provided by Shopware.
3. Review Extensions: Audit all custom extensions for ManyToMany associations that may expose sensitive data.

Long-Term Measures:

1. Implement API Security Testing: Regularly test the store-API for improper data exposure.
2. Enforce ApiAware Checks: Ensure all custom extensions properly mark fields as ApiAware or non-ApiAware.
3. Monitor for Exploitation: Use the provided detection rules to monitor for exploitation attempts.

Workarounds:

• If immediate patching is not possible, disable or restrict access to the store-API endpoints that handle associations.
• Implement a Web Application Firewall (WAF) rule to block requests with deeply nested association parameters.

Valters IT
Securing Digital Frontiers