-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the SecurityExtension class's Twig filter implementations (map, filter, reduce, sort). These functions validated only string-based callables against an allow list, but failed to check array-based callables (e.g., [ClassName, 'method']). This allowed attackers to bypass the allow list by crafting array-format PHP closures, leading to arbitrary code execution. The STAR Labs report demonstrates concrete exploitation via these filters using static method calls (e.g., CacheValueCompressor::uncompress, VarDumper::setHandler), confirming the vulnerability pattern. The functions' code structure (checking only is_string) and the documented bypass methods justify high confidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | <= 6.4.20.0 | 6.4.20.1 |
| shopware/core | composer | <= 6.4.20.0 | 6.4.20.1 |