Shopware Fix: Authorization Bypass, Livewire Hardening, Barcode XSS, Discount Race Condition

Vulnerability Overview This vulnerability involves authorization bypass and discount race condition issues within the Shopware platform. Specifically: 1. Authorization Bypass: - Multiple Filament actions (such as cancel, process, mark as paid, mark as complete, capture payment, archive, mark as delivered, edit) now require permission. - Previously, / permissions were sufficient to modify orders, change payment statuses, and trigger actual PSP gateways. - Product form sub-components (edit, inventory, SEO, shipping, files) now invoke directly via Livewire events rather than through the parent page's guard. - Order notes lacked checks and authorization, allowing any authenticated user to modify order notes and add free orders. - The settings/team index page lacked a method, and and were callable on users without user-viewing permissions. Both are now protected via access settings. - Role permission , , and were protected on read-only user permissions. Only users with this permission could create new permissions and assign them to roles, thereby escalating their own privileges. This has now been moved to access settings. - Payment methods/currencies/carriers , , , and bulk actions lacked permission protection. Access settings are now enforced. - Inventory form/strategy forms (settings sub-components): The same direct invocation bypass occurred on . This has been fixed. - Customer creation/storage: The defense was defensively switched from to an explicit allow list, removing the hidden field injection path. - Permissions / : Caused a fatal error due to lookup returning an empty array (concurrent deletion). This now returns early. - UI Consistency: All Filament action handlers have been moved from internal closures of to chain calls. Forbidden actions are now hidden in the UI rather than throwing errors upon click. 2. Livewire [#Locked] Hardening: - All public Eloquent model properties in Livewire components are now marked with to prevent client-side ID tampering. - Overridden models: , , , , , , , , , . 3. Barcode XSS: - Admin rendering of via used unescaped output. Product barcode text inputs ( , , , ) now constrain input to , closing the stored XSS attack surface. 4. Discount Race Condition + Per-User Limit (#510): - previously created an , then attempted a conditional insert for . After the condition check, the clause matched zero rows (once the limit was reached), but the order had already been submitted. After the discount was applied, would block at . - Fixes: - Introduced , which runs inside the existing , acquires a row-level , and performs an atomic compare-and-swap on . If , a is thrown and the transaction rolled back. No order is submitted. - previously read , where the counter was never incremented by any code path. It now queries and throws on the second redemption. This works regardless of the eligibility mode. - updated to use the same order-based check, denying application at the cart stage rather than as a surprise at checkout. Scope of Impact Authorization Bypass: Affects multiple Filament actions and Livewire components, potentially allowing unauthorized users to perform sensitive operations. Livewire Hardening: Affects all public Eloquent model properties, preventing client-side ID tampering. Barcode XSS: Affects product barcode text inputs, potentially leading to stored XSS attacks. Discount Race Condition: Affects discount application logic, potentially leading to over-discounting or race condition issues. Remediation 1. Authorization Bypass: - Add necessary permission checks to ensure only authorized users can perform sensitive operations. - Use attributes to protect public Eloquent model properties in Livewire components. 2. Livewire Hardening: - Add attributes to all public Eloquent model properties to prevent client-side ID tampering. 3. Barcode XSS: - Constrain product barcode text inputs using the regex , closing the stored XSS attack surface. 4. Discount Race Condition: - Introduce the method, utilizing row-level locks and atomic compare-and-swap to ensure the atomicity of discount application. - Update to use order-based checks, ensuring rejection at the cart application stage rather than at checkout. POC Code The above code blocks demonstrate specific implementations of some remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

Shopware Fix: Authorization Bypass, Livewire Hardening, Barcode XSS, Discount Race Condition

More from this source