CVE-2024-42356: shopware Code Injection — Fix

Description

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin.

Is your site exposed to CVE-2024-42356?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness Type (CWE)

CWE-1336 CWE-1336

CWE-94 CWE-94

Affected Products

Vendor	Product	Versions
shopware	shopware	< 6.5.8.13
shopware	shopware	6.6.0.0 — 6.6.5.1

References

Advisories & Patches

https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038 https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj

Frequently Asked Questions

What is CVE-2024-42356? +

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. It has a CVSS v3.1 base score of 8.3 (HIGH).

How severe is CVE-2024-42356? +

CVE-2024-42356 has a CVSS v3.1 score of 8.3 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-42356? +

CVE-2024-42356 affects products from shopware, specifically: shopware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-42356? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-71869

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression …

CVE-2026-55794

Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with …

CVE-2026-46636

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls …

CVE-2026-71871

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression …

CVE-2026-9177

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version …

CVE-2026-77129

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with …

CVE-2024-42356