Shopware v6.7.10.1 Security Release: Fixes for Privilege Escalation, SSRF, XSS, and API ACL Bypass

Vulnerability Overview Shopware v6.7.10.1 has been released as a security update, addressing multiple vulnerabilities including privilege escalation, admin account takeover, time-based attacks, privilege elevation, arbitrary SSO redirect targets, API ACL bypass, unauthorized payment triggering, stored XSS, and SSRF. Affected Areas Privilege Escalation: Bypass of sync API integration admin flag (GHSA-g9dp-48fh-4fng) Admin Account Takeover: Exposure of user recovery hash (GHSA-8v9p-g828-v98f) Time-based Attack: Allows enumeration of admin usernames (GHSA-7w5z-7jmm-9mvw) Privilege Elevation: Non-admin users can create admin accounts via user.create ACL (GHSA-v39m-97p8-ggg7) Arbitrary SSO Redirect Target: Shopware SSO redirect leads to arbitrary redirect targets (GHSA-4x3x-869w-xx3m) API ACL Bypass: Admin API ACL bypass on order state conversion endpoints (GHSA-86g3-2y9w-jr6) Unauthorized Payment Triggering: Foreign orders can trigger payments via /store-api/handle-payment (GHSA-9v5m-39wh-5cqh) Stored XSS: Via SVG file upload due to lack of SVG sanitization (GHSA-xvxc-hcng-7nhmc) SSRF: Bypass of IP verification in the Media External-Link Endpoint (GHSA-gd96-5pfx-4vxc) Remediation SVG Upload Validation: SVG uploads in the media subsystem are now validated against a strict passive allowlist before persistence. External Link Endpoint URL Validation: URL validation for the endpoint is now consistent with the existing validation in the flow. Code Snippets No POC code or exploit code available. Summary The Shopware v6.7.10.1 security update resolves multiple critical vulnerabilities, including privilege escalation, admin account takeover, time-based attacks, privilege elevation, arbitrary SSO redirect targets, API ACL bypass, unauthorized payment triggering, stored XSS, and SSRF. Remediation measures include strict validation for SVG uploads and enhanced URL validation for the external link endpoint.

Goal Reached Thanks to every supporter — we hit 100%!

Shopware v6.7.10.1 Security Release: Fixes for Privilege Escalation, SSRF, XSS, and API ACL Bypass

More from this source