Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-36102

CVE-2022-36102: Shopware access control list bypassed via crafted specific URLs

6.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-36102
GHSA ID
GHSA-qc43-pgwq-3q2q
EPSS Score
0.68899%
CWE
CWE-281
Published
9/16/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
shopware/shopwarecomposer<= 5.7.145.7.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper ACL enforcement when backend controllers are accessed via specific URL patterns. The root cause likely involves: (1) The preDispatch method in backend controllers (where ACL checks are typically enforced) failing to handle non-standard controller/action parameter formats, allowing bypass via crafted URLs. (2) The ACL system's controller/action resolution logic not properly normalizing input parameters, causing mismatches between requested resources and permission checks. The high confidence in AbstractController::preDispatch stems from its role as the primary ACL enforcement point, while the medium confidence in Acl::isAllowed reflects potential normalization flaws in permission mapping.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t I* ***k*n* **min *ontroll*rs *r* **ll** wit* * **rt*in not*tion, t** **L *oul* ** *yp*ss**. Us*rs *oul* *x**ut* **tions, w*i** t**y *r* norm*lly not **l* to *o. ### P*t***s W* r**omm*n* up**tin* to t** *urr*nt v*rsion *.*.**. You **n **t

Reasoning

T** vuln*r**ility st*ms *rom improp*r **L *n*or**m*nt w**n ***k*n* *ontroll*rs *r* ****ss** vi* sp**i*i* URL p*tt*rns. T** root **us* lik*ly involv*s: (*) T** pr**isp*t** m*t*o* in ***k*n* *ontroll*rs (w**r* **L ****ks *r* typi**lly *n*or***) **ilin*